Courseiva

CompTIA Linux+ (XK0-006) (XK0-006) — Questions 76–150

979 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 14

Page 3
76
MCQhard

During boot, a Linux system displays a kernel panic with the message 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

A.Incorrect GRUB timeout setting
B.A faulty RAM module causing memory errors
C.Corrupted initramfs missing necessary storage drivers
D.Filesystem corruption on the boot partition
AnswerC

A missing driver in initramfs prevents mounting the root filesystem.

Why this answer

The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate or access the root filesystem. This is most commonly caused by a corrupted or missing initramfs that lacks the necessary storage drivers (e.g., for SATA, NVMe, or LVM) to communicate with the root device. Without these drivers, the kernel cannot read the root filesystem, resulting in a panic.

Exam trap

The trap here is that candidates often confuse this error with filesystem corruption on the boot partition (Option D), but the 'unknown-block(0,0)' message specifically points to the kernel's inability to find the root device, which is a driver/module issue in the initramfs, not a filesystem problem.

How to eliminate wrong answers

Option A is wrong because an incorrect GRUB timeout setting only affects the boot menu delay, not the kernel's ability to mount the root filesystem. Option B is wrong because a faulty RAM module typically causes random crashes, segmentation faults, or memory errors, not a specific VFS mount failure with an unknown block device. Option D is wrong because filesystem corruption on the boot partition would prevent GRUB from loading the kernel or initramfs, but the error here occurs after the kernel is loaded and fails to mount the root filesystem, indicating the initramfs is the issue.

Full explanation →
77
MCQhard

A server running nftables has a rule set that allows incoming SSH from the management network (192.168.1.0/24). An administrator needs to insert a rule to drop SSH from all other sources. Which nft command accomplishes this? Assume the input chain is 'input' and the table is 'inet filter'.

A.nft add rule inet filter input ip saddr != 192.168.1.0/24 tcp dport 22 drop
B.nft insert rule inet filter input tcp dport 22 drop
C.nft replace rule inet filter input handle 1 tcp dport 22 drop
D.nft add rule inet filter input tcp dport 22 accept
AnswerA

This drops SSH from sources not within the management network.

Why this answer

The correct command is A. The existing rule allows SSH from 192.168.1.0/24. To drop SSH from all other sources, we need a rule that matches packets with source IP address not in that subnet and destination port 22, and then drops them.

The `add rule` subcommand appends the rule to the chain, which is appropriate because the allow rule for the management network should remain first. Using `ip saddr != 192.168.1.0/24` properly negates the source subnet. Option B drops SSH from any source (including the management network), which would block the allowed traffic.

Option C replaces an existing rule by handle but does not specify the source condition. Option D accepts SSH from all sources, which is not desired. Therefore, A is correct.

Exam trap

Candidates often confuse 'add' vs 'insert' in nftables. The question says 'insert a rule', but the correct approach is to append a drop rule after the allow rule. Adding the drop rule before the allow rule would make the allow rule irrelevant. 'Add rule' appends, which is correct here.

Full explanation →
78
Multi-Selecthard

A technician needs to remove all files in /tmp that are owned by the user 'jdoe' and have not been accessed in 10 days. Which THREE commands or options would be part of a correct solution? (Select THREE.)

Select 3 answers
A.find /tmp -user jdoe -atime +10 -exec rm {} \;
B.find /tmp -user jdoe -atime +10 -delete
C.find /tmp -user jdoe -delete
D.find /tmp -user jdoe -atime +10
E.find /tmp -user jdoe -mtime +10
AnswersA, B, D

Correct: alternative way to delete files matching the condition.

Why this answer

find /tmp -user jdoe -atime +10 -delete finds files belonging to jdoe, with last access more than 10 days ago, and deletes them. -atime measures access time. -delete is a direct action. Alternatively, using -exec rm {} \; works. The correct components include the path, -user, -atime, and action.

Full explanation →
79
MCQmedium

Based on the exhibit, the myapp service fails to start. Which troubleshooting step should be taken first?

A.Increase the RestartSec value to allow more time for startup
B.Verify that /usr/local/bin/myapp has execute permission
C.Inspect the system journal for more detailed error messages
D.Check that the application's configuration file exists and is readable
AnswerD

The error indicates a missing config file.

Why this answer

The exhibit shows a systemd unit file for the myapp service with `ExecStart=/usr/local/bin/myapp` and `Restart=on-failure`. The service fails to start, and the most common cause for such a failure is a missing or misconfigured application configuration file that the binary expects at launch. Option D is correct because verifying the configuration file's existence and readability is a fundamental prerequisite before investigating deeper issues like permissions or logs.

Exam trap

The trap here is that candidates often jump to inspecting logs (Option C) or adjusting restart timers (Option A) without first verifying the most basic prerequisite—the configuration file—which is a direct and faster check that aligns with the 'first step' in systematic troubleshooting.

How to eliminate wrong answers

Option A is wrong because increasing RestartSec only affects the delay between restart attempts, not the root cause of the startup failure; it would merely slow down retries without fixing the underlying issue. Option B is wrong because if the binary lacked execute permission, systemd would typically report a specific 'Permission denied' error in the journal, and the exhibit does not indicate that; also, the binary path is hardcoded in ExecStart, and execute permission is a secondary check after ensuring the configuration file is valid. Option C is wrong because while inspecting the system journal is a valid troubleshooting step, it is not the first step; the question asks for the first step, and checking the configuration file is a quicker, more direct check that often reveals the problem without needing to parse logs.

Full explanation →
80
MCQmedium

The system is experiencing slow disk I/O. Based on the exhibit, which step should the administrator take to improve performance?

A.Increase the filesystem block size
B.Enable write-back caching on the drive using hdparm
C.Add the 'noatime' mount option in /etc/fstab
D.Change the I/O scheduler to 'deadline'
AnswerC

Correct: Reduces disk writes by not updating access times.

Why this answer

The 'noatime' mount option disables updating the access time (atime) on every file read, which eliminates a significant source of metadata write operations. Since the exhibit indicates slow disk I/O, reducing unnecessary writes directly improves performance by freeing I/O bandwidth for actual data transfers. This is a standard, low-risk optimization for workloads where access timestamps are not required.

Exam trap

The trap here is that candidates often focus on I/O schedulers or caching mechanisms to fix slow I/O, overlooking the simple and effective filesystem mount option that reduces unnecessary write operations.

How to eliminate wrong answers

Option A is wrong because increasing the filesystem block size can improve throughput for large sequential I/O but may waste space and degrade performance for small random I/O; it does not address the root cause of slow disk I/O from excessive metadata writes. Option B is wrong because enabling write-back caching with hdparm on a drive that does not support it or without proper power-loss protection can cause data corruption; it is a risky hardware-level change, not a safe filesystem tuning step. Option D is wrong because changing the I/O scheduler to 'deadline' may help with latency for certain workloads, but it does not reduce the volume of I/O operations; the exhibit points to unnecessary metadata updates, which the scheduler cannot mitigate.

Full explanation →
81
MCQhard

An organization is migrating from a legacy automation tool to Ansible. Which of the following best describes the role of Ansible playbooks in configuration management?

A.YAML files that declare the desired state of systems and tasks to achieve it.
B.Executable scripts written in Python that run on managed nodes.
C.Configuration files that list the inventory of managed hosts.
D.Shell scripts that execute ad-hoc commands across servers.
AnswerA

Defines tasks and states declaratively.

Why this answer

Ansible playbooks are YAML files that declare the desired state of systems and the tasks to achieve that state, making them the core configuration management tool in Ansible. They are idempotent, meaning running them multiple times yields the same result, and they use modules to enforce configurations without requiring an agent on managed nodes.

Exam trap

The trap here is confusing playbooks with ad-hoc commands or inventory files, as candidates often think playbooks are scripts that execute directly on nodes rather than declarative YAML files that define desired state and tasks.

How to eliminate wrong answers

Option B is wrong because Ansible playbooks are not executable Python scripts; they are YAML declarative files that invoke Python modules on the control node, not scripts that run directly on managed nodes. Option C is wrong because inventory files, not playbooks, list managed hosts; playbooks define tasks and desired states. Option D is wrong because playbooks are not shell scripts; they are structured YAML files that orchestrate idempotent tasks, while ad-hoc commands are run via the `ansible` command, not playbooks.

Full explanation →
82
Multi-Selectmedium

A bash script uses a loop to iterate over files in a directory. Which TWO of the following loop constructs will correctly iterate over each .txt file in the current directory? (Select TWO).

Select 2 answers
A.for file in '*.txt'; do
B.for file in $(ls *.txt); do
C.for file in *.txt; do
D.for ((i=0; i<${#files[@]}; i++)); do
E.while IFS= read -r file; do done < <(find . -maxdepth 1 -name '*.txt')
AnswersC, E

Glob expands to all .txt files.

Why this answer

for file in *.txt expands to all matching filenames; the C-style for loop can also be used with array of filenames, but direct expansion is simpler.

Full explanation →
83
MCQmedium

A company is deploying a new web application using Docker containers. The application requires configuration values that vary between environments (development, staging, production). Which approach ensures the configuration is securely managed and applied without modifying the container image?

A.Pass configuration via environment variables and use Docker secrets for sensitive data.
B.Build separate images for each environment with the configuration baked in.
C.Store configuration in a JSON file within the base image and override it at runtime.
D.Use a Dockerfile to copy the configuration file from the host at build time.
AnswerA

Environment variables allow runtime configuration without modifying the image, and secrets provide secure handling of sensitive data.

Why this answer

Docker supports passing configuration via environment variables at runtime without altering the image, and Docker secrets securely manage sensitive data (e.g., passwords, API keys) by storing them in encrypted memory and mounting them as temporary files in `/run/secrets/`. This decouples configuration from the immutable image, adhering to the twelve-factor app methodology and ensuring environment-specific values are applied without rebuilding.

Exam trap

CompTIA often tests the misconception that environment variables alone are sufficient for all configuration, including secrets, but the trap here is that Docker secrets provide an additional security layer for sensitive data, while environment variables are appropriate for non-sensitive configuration values.

How to eliminate wrong answers

Option B is wrong because building separate images for each environment violates immutability and defeats the purpose of a single deployable artifact, leading to configuration drift and increased maintenance overhead. Option C is wrong because storing configuration in a JSON file within the base image requires modifying the image or using a bind mount at runtime, which either breaks immutability or relies on host filesystem access, not a secure or portable approach. Option D is wrong because using a Dockerfile to copy a configuration file from the host at build time bakes the configuration into the image, making it environment-specific and requiring separate builds for each environment, which is inefficient and insecure.

Full explanation →
84
Multi-Selectmedium

An administrator needs to harden SSH access. Which TWO settings in /etc/ssh/sshd_config are recommended to improve security? (Choose two.)

Select 2 answers
A.PermitRootLogin yes
B.PermitRootLogin no
C.Protocol 1
D.PasswordAuthentication no
E.Port 22
AnswersB, D

Prevents direct root login.

Why this answer

Setting `PermitRootLogin no` disables direct root login via SSH, forcing administrators to log in as a regular user and then use `su` or `sudo` for privileged commands. This prevents attackers from targeting the root account directly and ensures all root-level actions are logged under the individual user's session. Option D is correct because setting `PasswordAuthentication no` disables password-based authentication, requiring the use of SSH key pairs, which are resistant to brute-force attacks and credential stuffing.

Exam trap

The trap here is that candidates often think changing the default SSH port (Option E) is a strong security measure, but the exam considers it a weak control compared to disabling root login and password authentication, which directly address authentication vulnerabilities.

Full explanation →
85
Multi-Selectmedium

A Linux technician is troubleshooting a system that is experiencing high disk I/O wait times. Which TWO commands can be used to identify disk I/O performance issues? (Choose two.)

Select 2 answers
A.lsof
B.vmstat
C.iostat
D.free -h
E.dmesg
AnswersB, C

vmstat displays system processes, memory, paging, block I/O, traps, and CPU activity, including I/O wait.

Why this answer

iostat provides detailed disk I/O statistics including %util and await. dmesg may show disk errors but not performance stats. vmstat shows I/O wait (wa) column. free shows memory, lsof lists open files.

Full explanation →
86
MCQmedium

A service called 'myapp' fails to start automatically after a system reboot. The administrator wants to ensure the service starts at boot. Which systemctl command should be used?

A.systemctl daemon-reload
B.systemctl start myapp
C.systemctl enable myapp
D.systemctl reenable myapp
AnswerC

Correct: enable configures the service to start at boot.

Why this answer

The `systemctl enable myapp` command creates the necessary symlinks in the systemd unit configuration directories (typically `/etc/systemd/system/multi-user.target.wants/`) so that the `myapp` service is automatically started at boot. This is the correct approach because the question specifically asks to ensure the service starts after a reboot, not to start it immediately.

Exam trap

The trap here is that candidates often confuse `systemctl start` (immediate start) with `systemctl enable` (boot-time start), or they mistakenly think `systemctl reenable` is a valid command for re-enabling a service.

How to eliminate wrong answers

Option A is wrong because `systemctl daemon-reload` reloads the systemd manager configuration and unit files, but it does not enable a service to start at boot. Option B is wrong because `systemctl start myapp` starts the service immediately in the current session but does not configure it to start automatically after a reboot. Option D is wrong because `systemctl reenable myapp` is not a valid systemctl command; the correct command to re-enable a service is `systemctl enable myapp` (which can be run again to recreate symlinks), and `reenable` is a common misconception or typo.

Full explanation →
87
MCQmedium

A company runs a critical web application on a single server using Docker containers. The application consists of a web frontend container and a backend API container. Recently, the server ran out of disk space due to Docker logs and temporary images. The sysadmin is tasked with automating cleanup to prevent recurrence. The solution must not disrupt running containers. Which approach should be taken?

A.Increase disk space by adding a new volume.
B.Create a script that stops all containers, removes unused images, and restarts containers.
C.Schedule a cron job to run `docker system prune -a -f` daily.
D.Configure log rotation for containers using `--log-opt max-size=10m` and `--log-opt max-file=3` in the Docker run command, and schedule `docker image prune -f` weekly.
AnswerD

Log rotation keeps log files small, and pruning unused images safely removes them without affecting running containers.

Why this answer

It addresses both root causes: log growth and dangling images. Configuring `--log-opt max-size=10m` and `--log-opt max-file=3` limits container log file size and count without stopping containers, while `docker image prune -f` removes unused images safely. This combination prevents disk exhaustion without disrupting running containers, meeting all requirements.

Exam trap

The trap here is that candidates may choose Option C because `docker system prune -a -f` seems like a comprehensive cleanup, but they overlook that it can remove images needed by running containers (if they use intermediate layers) and does not address log growth, which is the primary cause of disk space exhaustion in this scenario.

How to eliminate wrong answers

Option A is wrong because adding a new volume only postpones the problem by increasing capacity, but does not automate cleanup of logs or unused images, so disk space will eventually run out again. Option B is wrong because stopping all containers disrupts the critical web application, violating the requirement to not disrupt running containers. Option C is wrong because `docker system prune -a -f` removes all unused images, containers, networks, and volumes, including those that might be needed for running containers (e.g., intermediate layers), and it does not address log rotation, so logs will continue to grow unchecked.

Full explanation →
88
Multi-Selecthard

A system fails to boot with a kernel panic. The administrator wants to recover by accessing a root shell. Which THREE methods can be used to achieve this?

Select 3 answers
A.Run 'fsck /dev/sda1' from the GRUB command line
B.Append 'single' to the kernel command line in GRUB
C.Press 'e' in GRUB and remove 'quiet'
D.Append 'rd.break' to the kernel command line in GRUB
E.Boot from a live CD and chroot into the installed system
AnswersB, D, E

Boots into single-user mode.

Why this answer

Appending 'single' to the kernel command line in GRUB instructs the kernel to boot into single-user mode, which provides a root shell without requiring a password. This is a standard method for recovering from a kernel panic by allowing the administrator to repair filesystems or troubleshoot boot issues.

Exam trap

The trap here is that candidates may confuse the GRUB command line with a Linux shell, mistakenly thinking filesystem repair commands like fsck can be run directly from GRUB, or they may think removing 'quiet' alone grants root access when it only affects verbosity.

Full explanation →
89
MCQeasy

An administrator needs to schedule a backup script located at '/usr/local/bin/backup.sh' to run every Sunday at 2:30 AM. The server uses cron for task scheduling. The administrator currently has the following crontab entry: '30 2 * * 0 /usr/local/bin/backup.sh'. However, the administrator wants to verify that the cron job is configured correctly and will run as expected. Which of the following commands should the administrator use to list the current user's cron jobs and verify the entry?

A.cat /var/spool/cron/crontabs/root
B.systemctl status cron
C.cron -l
D.crontab -l
AnswerD

Lists the current user's crontab entries, allowing verification.

Why this answer

The 'crontab -l' command lists the current user's crontab entries. Option D is correct. 'cron -l' is not a valid command. 'cat /var/spool/cron/crontabs/root' might work for root but not for a regular user, and the path varies. 'systemctl status cron' shows the cron service status, not the job list.

Full explanation →
90
Multi-Selecthard

An administrator wants to locate files that have the SUID or SGID special permission set. Which three find commands can accomplish this? (Choose three.)

Select 3 answers
A.find / -perm 2000
B.find / -perm /6000
C.find / -perm /4000
D.find / -perm /2000
E.find / -perm 4000
AnswersB, C, D

This finds files with either SUID or SGID set.

Why this answer

The find command with -perm can search for permissions in symbolic or octal modes, and using -4000 or -2000 finds SUID or SGID respectively.

Full explanation →
91
Matchingmedium

Match each Linux package manager to its distribution family.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Debian/Ubuntu

RHEL/CentOS 7

Fedora/RHEL 8+

openSUSE/SLES

Arch Linux

Why these pairings

Different Linux distributions use different package managers: apt is for Debian-based, yum/dnf for Red Hat-based, and pacman for Arch Linux. Common confusions include mixing apt with Red Hat or yum with Arch.

Full explanation →
92
Multi-Selectmedium

Which THREE of the following actions can help prevent unauthorized access to a Linux server via SSH?

Select 3 answers
A.Allow only specific users with AllowUsers.
B.Set MaxAuthTries to 6.
C.Use protocol version 1.
D.Disable password authentication.
E.Set PermitRootLogin to no.
AnswersA, D, E

Restricts SSH access to authorized users.

Why this answer

The `AllowUsers` directive in `/etc/ssh/sshd_config` restricts SSH logins to only the specified user accounts, blocking all others even if they have valid credentials. This reduces the attack surface by explicitly whitelisting authorized users, making it an effective access control measure.

Exam trap

CompTIA often tests the misconception that increasing `MaxAuthTries` (option B) or using protocol version 1 (option C) improves security, when in fact they either have no preventive effect or actively weaken security.

Full explanation →
93
MCQhard

A server fails to boot with a kernel panic after a system update. The administrator suspects a corrupt initramfs. Which GRUB boot parameter should be added temporarily to boot into an emergency shell where the filesystem can be repaired?

A.rd.break
B.emergency
C.single
D.nomodeset
AnswerA

Correct. rd.break drops to a shell before the root filesystem is mounted, allowing initramfs repair.

Why this answer

The `rd.break` parameter causes systemd to break before the initramfs transitions to the real root, providing an emergency shell for repair. 'single' boots to single-user mode but requires a working initramfs.

Full explanation →
94
MCQmedium

A technician needs to check the current memory usage on a Linux system, including buffers and cache. Which command provides the most user-friendly output?

A.free -h
B.cat /proc/meminfo
C.iostat -m
D.vmstat -s
AnswerA

free -h shows memory usage with buffers/cache in human-readable form.

Why this answer

The `free -h` command displays memory usage in a human-readable format (e.g., KiB, MiB, GiB) and explicitly breaks down total, used, free, shared, buffers/cache, and available memory. This makes it the most user-friendly option for quickly assessing current memory usage including buffers and cache.

Exam trap

The trap here is that candidates may choose `cat /proc/meminfo` because it contains all the raw data, but the question specifically asks for the 'most user-friendly' output, which `free -h` provides with its human-readable scaling and clear summary columns.

How to eliminate wrong answers

Option B is wrong because `cat /proc/meminfo` provides raw, detailed memory statistics in a machine-readable format without any human-friendly scaling or summary, making it less user-friendly for a quick check. Option C is wrong because `iostat -m` reports CPU and I/O statistics (in megabytes), not memory usage, buffers, or cache. Option D is wrong because `vmstat -s` displays a summary of virtual memory statistics (including paging, swapping, and CPU events) but does not present buffers/cache in a clear, human-readable layout like `free -h`.

Full explanation →
95
MCQeasy

A Linux administrator needs to locate all files in /var/log that were modified more than 7 days ago. Which command should be used?

A.find /var/log -mtime +7
B.grep -mtime +7 /var/log
C.ls -mtime +7 /var/log
D.locate -mtime +7 /var/log
AnswerA

Correct: find with -mtime +7.

Why this answer

The find command with -mtime +7 finds files modified more than 7 days ago. locate uses a database and does not support -mtime; grep is for text search; ls does not filter by modification time.

Full explanation →
96
MCQhard

An administrator is troubleshooting a service that fails to start. They want to trace the system calls made by the service binary. Which command should they use?

A.ltrace
B.dmesg
C.strace
D.lsof
AnswerC

Correct tool for system call tracing.

Why this answer

strace traces system calls and signals. It is used to debug what a program is doing at the kernel level.

Full explanation →
97
MCQmedium

Refer to the exhibit. A Docker container using a bind mount fails to start with a permission error. What is the most likely cause?

A.The container is running in privileged mode.
B.The Docker daemon is not running as root.
C.SELinux is blocking the mount.
D.The volume path on the host does not exist.
AnswerC

SELinux policies can restrict bind mounts, resulting in permission denied errors.

Why this answer

When a Docker container uses a bind mount and fails with a permission error, SELinux is a common cause because it enforces mandatory access controls that can block container processes from accessing host files. By default, SELinux labels container processes with a confined domain (e.g., container_t), and if the bind-mounted host directory lacks the proper SELinux context (e.g., container_file_t), the mount is denied. This is resolved by adding the `:Z` or `:z` flag to the bind mount in the Docker run command to relabel the host directory appropriately.

Exam trap

CompTIA often tests the distinction between filesystem permission errors (e.g., user ID mismatch) and SELinux denials, where candidates mistakenly choose 'privileged mode' or 'daemon not root' because they overlook SELinux as the underlying cause in a bind mount context.

How to eliminate wrong answers

Option A is wrong because running the container in privileged mode grants all capabilities and bypasses most security restrictions, but it does not automatically resolve SELinux denials; in fact, privileged mode may still be blocked by SELinux unless SELinux is disabled or the context is set. Option B is wrong because the Docker daemon typically runs as root, and even if it did not, the permission error from a bind mount is more likely related to SELinux or filesystem permissions, not the daemon's user ID. Option D is wrong because if the volume path on the host did not exist, Docker would create it as a directory (unless a file is expected), and the error would be a 'no such file or directory' message, not a permission error.

Full explanation →
98
MCQmedium

An administrator wants to list all USB storage devices attached to the system. Which command provides this information?

A.lsblk
B.fdisk -l
C.lspci
D.lsusb
AnswerA

Correct: lsblk lists block devices including USB drives.

Why this answer

lsblk lists block devices; USB storage typically appears as sda, sdb, etc.

Full explanation →
99
MCQhard

A system administrator needs to capture network traffic on interface eth0, filtering for packets to or from host 10.0.0.1, and save the output to a file for later analysis. Which command accomplishes this?

A.tcpdump -i eth0 host 10.0.0.1 -w capture.pcap
B.tcpdump -n port 10.0.0.1 -w capture.pcap
C.tcpdump -i eth0 -host 10.0.0.1 > capture.pcap
D.tcpdump -i eth0 -w capture.pcap host 10.0.0.1
AnswerA, D

Correct. The syntax '-i eth0 host 10.0.0.1 -w capture.pcap' captures packets to/from host 10.0.0.1 on interface eth0 and writes to file.

Why this answer

Both tcpdump -i eth0 host 10.0.0.1 -w capture.pcap (A) and tcpdump -i eth0 -w capture.pcap host 10.0.0.1 (D) are valid commands to capture packets to/from host 10.0.0.1 on interface eth0 and write them to a file. In tcpdump, the -w option can be placed before or after the filter expression, as long as -w is followed by the filename. Options B and C are incorrect because they use wrong syntax or options.

Full explanation →
100
MCQeasy

A Linux administrator needs to add a new user named 'jdoe' with a home directory and a bash shell. Which command accomplishes this?

A.usermod -m -s /bin/bash jdoe
B.adduser jdoe --home /home/jdoe --shell /bin/bash
C.useradd -m -s /bin/bash jdoe
D.passwd -m jdoe
AnswerC

This creates the home directory and sets the shell.

Why this answer

The useradd command with -m creates the home directory and -s sets the shell. useradd -m -s /bin/bash jdoe is correct.

Full explanation →
101
MCQmedium

An administrator is troubleshooting a server that fails to boot. The system displays 'kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0).' Which of the following is the most likely cause?

A.The init binary is missing
B.The hard drive has a hardware failure
C.The kernel image is corrupted
D.The Master Boot Record is damaged
E.Incorrect root= parameter in the kernel command line
AnswerE

The root filesystem cannot be mounted due to wrong root= parameter.

Why this answer

The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate the root filesystem. The 'unknown-block(0,0)' value means the kernel received no valid device number for the root partition, which is almost always caused by an incorrect or missing 'root=' parameter in the kernel command line (e.g., in GRUB). This prevents the kernel from finding the correct block device to mount as '/'.

Exam trap

The trap here is that candidates often confuse a kernel panic at the VFS mount stage with a corrupted kernel image or hardware failure, when the real cause is a misconfigured bootloader parameter that prevents the kernel from finding the root filesystem.

How to eliminate wrong answers

Option A is wrong because a missing init binary would cause a kernel panic after root filesystem mounting, not the VFS mount failure on unknown-block(0,0). Option B is wrong because a hard drive hardware failure typically produces I/O errors or a different panic message, not the specific 'unknown-block(0,0)' which indicates a missing device identifier. Option C is wrong because a corrupted kernel image usually causes a panic earlier in the boot process (e.g., 'Kernel panic - not syncing: Attempted to kill init!') or a crash before VFS initialization.

Option D is wrong because a damaged Master Boot Record (MBR) prevents the bootloader from loading the kernel at all, resulting in a 'Missing operating system' or bootloader error, not a kernel panic after the kernel has started.

Full explanation →
102
MCQhard

A system administrator needs to install a package from a local RPM file without resolving dependencies automatically. Which command should be used?

A.rpm -i package.rpm
B.rpm -U package.rpm
C.yum localinstall package.rpm
D.dnf install ./package.rpm
AnswerA

Correct: rpm -i installs the package locally without dependency resolution.

Why this answer

The `rpm -i package.rpm` command installs the specified RPM package without automatically resolving dependencies. The `-i` flag stands for 'install' and, unlike `-U` (upgrade) or higher-level tools like `yum` or `dnf`, it does not attempt to fetch or satisfy missing dependencies from configured repositories. This is the correct choice when the requirement is to install a local RPM file while explicitly avoiding automatic dependency resolution.

Exam trap

The trap here is that candidates often confuse `rpm -i` with `rpm -U` or assume that higher-level tools like `yum` or `dnf` can be used to install local RPMs without dependency resolution, but those tools are designed to automatically resolve dependencies, which directly violates the question's constraint.

How to eliminate wrong answers

Option B is wrong because `rpm -U package.rpm` performs an upgrade or install, but it still does not resolve dependencies automatically; however, the question specifically asks for a command that installs without resolving dependencies, and `-U` is semantically an upgrade operation, not a pure install. Option C is wrong because `yum localinstall package.rpm` is a higher-level command that resolves and installs dependencies from repositories, which contradicts the requirement to avoid automatic dependency resolution. Option D is wrong because `dnf install ./package.rpm` also resolves dependencies automatically using DNF's dependency solver, making it unsuitable for the stated requirement.

Full explanation →
103
MCQmedium

Refer to the exhibit. A system administrator notices that backend1.example.com is receiving significantly more traffic than the other two servers. What is the most likely reason?

A.Session persistence (sticky sessions) is enabled, routing returning users to the same server.
B.Weighted load balancing distributes traffic proportionally; backend1 has the highest weight.
C.backend1 is the only server that passes health checks.
D.The proxy_next_upstream directive causes requests to be retried on backend1 first.
AnswerB

With weight=5, backend1 gets the largest share of traffic.

Why this answer

The upstream block uses weighted round-robin with weights 5, 3, and 2. The total weight is 10, so backend1 receives 5/10 = 50% of requests, backend2 receives 30%, and backend3 receives 20%. This distribution matches the observed pattern.

Option A is incorrect because session persistence is not configured. Option C is incorrect because there is no health check mechanism shown. Option D is irrelevant as the proxy_next_upstream directive only affects retries on failure.

Full explanation →
104
Drag & Dropmedium

Drag and drop the steps to mount a new filesystem in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Mounting a filesystem requires creating a mount point and using the mount command with the device and mount point.

Full explanation →
105
MCQhard

A company requires that all systems be configured to log all authentication attempts, both successful and failed. Which configuration file and directive should be used to ensure all auth messages are logged to /var/log/secure?

A.In /etc/rsyslog.conf: *.info /var/log/secure
B.In /etc/rsyslog.conf: auth.* /var/log/secure
C.In /etc/rsyslog.conf: authpriv.* /var/log/secure
D.In /etc/rsyslog.conf: kern.* /var/log/secure
AnswerC

Correct facility and action.

Why this answer

In rsyslog, the `authpriv` facility covers authentication and authorization messages, including both successful and failed login attempts. The directive `authpriv.* /var/log/secure` directs all messages from this facility to `/var/log/secure`, which is the standard secure log file on RHEL/CentOS systems. This meets the requirement to log all authentication attempts.

Exam trap

The trap here is that candidates confuse the `auth` and `authpriv` facilities, assuming `auth.*` is correct because it sounds like 'authentication', but `authpriv` is the actual facility used by modern Linux authentication subsystems like PAM and sshd.

How to eliminate wrong answers

Option A is wrong because `*.info` selects all messages with severity info or higher, which would flood `/var/log/secure` with non-authentication messages (e.g., cron, mail, daemon logs), not specifically auth messages. Option B is wrong because `auth.*` uses the `auth` facility, which is typically used for legacy or non-privileged authentication; on modern Linux systems, authentication logs are generated under the `authpriv` facility, so `auth.*` would miss many auth-related messages. Option D is wrong because `kern.*` selects kernel messages only, which are unrelated to authentication attempts and are typically logged to `/var/log/kern.log` or `/var/log/messages`.

Full explanation →
106
MCQeasy

A Linux administrator needs to check which process is using the most memory on a system. The administrator wants to view dynamically updating list of processes sorted by memory usage. Which command should the administrator use?

A.ps aux --sort=-%mem
B.top -o %MEM
C.htop -s MEM
D.vmstat 1 5
AnswerB

top with -o sorts by the specified field and updates dynamically.

Why this answer

The `top` command provides a real-time, dynamically updating view of system processes. The `-o %MEM` option sorts the process list by memory usage (the %MEM column), allowing the administrator to immediately see which process is consuming the most memory. This directly meets the requirement for a dynamically updating list sorted by memory usage.

Exam trap

The trap here is that candidates often confuse static commands like `ps` with dynamic monitoring tools like `top`, or they assume `htop` is always available, when the exam expects the standard, default-installed command `top`.

How to eliminate wrong answers

Option A is wrong because `ps aux --sort=-%mem` displays a static snapshot of processes sorted by memory usage, not a dynamically updating list. Option C is wrong because `htop -s MEM` sorts by the MEM column, but `htop` is not guaranteed to be installed by default on all Linux distributions, and the question asks for a command that the administrator 'should use' — `top` is the standard, universally available tool. Option D is wrong because `vmstat 1 5` reports virtual memory statistics (like swapping, CPU, and I/O) at one-second intervals for five samples, not a list of processes sorted by memory usage.

Full explanation →
107
MCQmedium

An administrator needs to prevent a specific user 'bob' from logging in via SSH while allowing other users. Which configuration directive should be added to /etc/ssh/sshd_config?

A.AllowUsers alice charlie
B.PermitRootLogin no
C.DenyUsers bob
D.AllowUsers bob
AnswerC

Correct. DenyUsers bob blocks only bob from SSH login, leaving all other users unaffected.

Why this answer

The DenyUsers directive in /etc/ssh/sshd_config explicitly blocks specific usernames from logging in via SSH. By specifying 'DenyUsers bob', only user bob is denied, while all other users remain allowed. This matches the requirement to prevent bob without affecting others.

AllowUsers with a whitelist would also block bob but would require listing every other user, which is impractical and not the intended solution.

Exam trap

The trap is that candidates may choose AllowUsers with a whitelist (like option A) thinking it blocks bob, but it also blocks all other users not in the list. The question's requirement to 'prevent bob while allowing other users' is best met by a blacklist approach using DenyUsers. This tests understanding of whitelist vs. blacklist logic.

How to eliminate wrong answers

Option B is wrong because PermitRootLogin no only prevents the root user from logging in via SSH; it has no effect on regular users like 'bob'. Option C is wrong because DenyUsers bob would explicitly block 'bob', but the question asks for a directive that prevents 'bob' while allowing other users; while DenyUsers works, the correct answer is AllowUsers as it is the more direct and commonly tested approach for this scenario. Option D is wrong because AllowUsers bob would permit only 'bob' to log in, blocking all other users including alice and charlie, which is the opposite of the requirement.

Full explanation →
108
MCQmedium

A Bash script contains the following line: set -e. What is the effect of this command?

A.It enables debugging by printing commands and their arguments as they are executed.
B.It prevents the script from overwriting existing files.
C.It causes the script to exit if any command fails.
D.It treats unset variables as an error and exits.
AnswerC

Correct. set -e exits on error.

Why this answer

set -e causes the script to exit immediately if any command exits with a non-zero status. This is useful for catching errors early.

Full explanation →
109
MCQeasy

In bash, what is the difference between single quotes and double quotes?

A.Single quotes prevent variable expansion, double quotes allow it.
B.Both allow variable expansion, but double quotes also allow globbing.
C.Single quotes allow variable expansion, double quotes do not.
D.There is no difference; they are interchangeable.
AnswerA

Correct. Single quotes are literal, double quotes interpret variables.

Why this answer

Single quotes preserve the literal value of each character, while double quotes allow variable expansion and command substitution.

Full explanation →
110
MCQmedium

A user reports that a service fails to start with the error 'Permission denied'. The service runs under a non-root user. Which command should the administrator use to check if the service has the correct file permissions?

A.namei -l /path/to/service
B.ls -l /path/to/service
C.getfacl /path/to/service
D.stat /path/to/service
AnswerA

namei -l walks the entire path and shows permissions for each component, revealing any 'Permission denied' at intermediate steps.

Why this answer

The error 'Permission denied' when starting a service under a non-root user often involves not just the file's own permissions but also the permissions of each directory in the path leading to the service binary. The `namei -l` command recursively lists the permissions of every component in the path, revealing if any parent directory lacks execute (search) permission for the service user, which would block access even if the binary itself is correctly set. This makes it the most comprehensive tool for diagnosing path-based permission issues.

Exam trap

The trap here is that candidates assume `ls -l` or `stat` on the service binary alone is sufficient, overlooking that the 'Permission denied' error often originates from a missing execute bit on a parent directory in the path, which only `namei -l` can reveal by checking every component.

How to eliminate wrong answers

Option B is wrong because `ls -l` only shows the permissions of the final file or directory, not the intermediate directories in the path, so it cannot detect a missing execute permission on a parent directory that causes the 'Permission denied' error. Option C is wrong because `getfacl` displays only the ACL entries for a single file or directory, not the recursive path permissions, and ACLs are an extended permission mechanism that may not be the root cause if standard Unix permissions are misconfigured on a parent directory. Option D is wrong because `stat` provides detailed metadata (inode, timestamps, permissions) for a single file or directory but, like `ls -l`, does not traverse and display permissions for each component in the path, missing the common scenario where a parent directory lacks the execute bit.

Full explanation →
111
Multi-Selecteasy

Which THREE of the following commands are used to manage iptables rules? (Select THREE.)

Select 3 answers
A.iptables -p
B.iptables -j
C.iptables -I
D.iptables -A
E.iptables -D
AnswersC, D, E

Inserts a rule at a specified position.

Why this answer

iptables is used with options -A (append), -I (insert), -D (delete). -L lists rules, -F flushes. -j is for target, not a command itself. -p is for protocol. -s is source.

Full explanation →
112
MCQeasy

A Linux administrator wants to change the permissions of a file to allow the owner to read, write, and execute; the group to read and execute; and others to read only. Which chmod command should be used?

A.chmod 764 file
B.chmod 744 file
C.chmod 755 file
D.chmod 754 file
AnswerD

Correct: owner rwx, group r-x, others r--.

Why this answer

Octal 754 corresponds to rwxr-xr--: owner rwx (7), group r-x (5), others r-- (4).

Full explanation →
113
MCQmedium

An administrator wants to restrict SSH access to only users in the 'sshusers' group. Which configuration directive should be added to /etc/ssh/sshd_config?

A.AllowUsers sshusers
B.Match Group sshusers
C.AllowGroups sshusers
D.DenyGroups all
AnswerC

AllowGroups allows only users in the specified group to log in via SSH.

Why this answer

The AllowGroups directive in sshd_config restricts SSH access to users who are members of the specified group(s).

Full explanation →
114
MCQmedium

A system administrator wants to view the last 10 lines of a log file and also save those lines to another file for analysis. Which command should the administrator use?

A.head -n 10 file | tee output.txt
B.cat file | tee output.txt
C.tail -n 10 file | tee output.txt
D.tee output.txt < tail -n 10 file
AnswerC

Correct: tail shows last 10 lines, tee saves to file and displays.

Why this answer

tail -n 10 file | tee output.txt displays the last 10 lines of 'file' and writes them to 'output.txt'. Option A uses head, which shows the first lines, not the last. Option B uses cat, which outputs the entire file, not just the last 10 lines.

Option D uses tee without a pipe, which is syntactically incorrect; tee reads from stdin, so it requires a pipe from tail.

Full explanation →
115
MCQhard

During boot, a Linux system displays a kernel panic. The administrator suspects a corrupt initramfs. Which GRUB boot parameter can be added to boot into an emergency shell before the initramfs is loaded, allowing repair?

A.single
B.init=/bin/bash
C.rd.break
D.emergency
AnswerC

Correct: rd.break breaks before initramfs pivot.

Why this answer

The rd.break parameter stops the boot process before the initramfs is fully loaded, dropping to a shell for troubleshooting.

Full explanation →
116
MCQeasy

A user cannot access a file. The file has permissions 640 and is owned by root:root. The user is not root and not in the root group. Which command should the administrator use to allow the user to read the file?

A.chmod o+r file
B.chgrp user file
C.setfacl -m u:user:r file
D.chown user file
AnswerA

Correct: Adds read permission for others.

Why this answer

The file has permissions 640, which means the owner (root) has read/write, the group (root) has read, and others have no permissions. Since the user is not root and not in the root group, they fall into the 'others' category. The command `chmod o+r file` adds read permission for others, allowing the user to read the file without changing ownership or group membership.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing `setfacl` or `chown` when a simple `chmod` on the 'others' class is the correct and most efficient fix for a user who is neither the owner nor a group member.

How to eliminate wrong answers

Option B is wrong because `chgrp user file` changes the group owner of the file to the user's primary group, but the user may not be in that group (or the group may still not grant read access if the group permissions are insufficient). Option C is wrong because `setfacl -m u:user:r file` would work to grant read access via an ACL, but the question asks for a command to allow the user to read the file, and while this is technically valid, it is not the most direct or standard answer; the exam expects the simpler `chmod` solution. Option D is wrong because `chown user file` changes the file owner to the user, which would grant the user owner permissions (read/write), but this is overly permissive and unnecessary when only read access is needed; it also violates the principle of least privilege.

Full explanation →
117
Multi-Selectmedium

A Linux administrator is configuring file permissions for a shared directory used by a development team. The administrator wants to ensure that any new files created in the directory inherit the group ownership of the directory and that the group has read and write permissions on those files. Which TWO actions should the administrator take? (Choose TWO.)

Select 2 answers
A.Use the command 'chmod g+s /shared' to set the SGID bit on the directory.
B.Use the command 'setfacl -m g:devteam:rw /shared' to set an ACL on the directory.
C.Use the command 'chmod 2770 /shared' to set permissions with SGID and full access for owner and group.
D.Use the command 'umask 0007' to set the umask for the directory.
E.Use the command 'setfacl -d -m g:devteam:rw /shared' to set a default ACL on the directory.
AnswersA, E

SGID on a directory causes new files to inherit the directory's group.

Why this answer

Setting the SGID bit (chmod g+s) on the directory ensures new files inherit the group ownership. Using an ACL with default entries (setfacl -d) can set default permissions for new files.

Full explanation →
118
Multi-Selectmedium

An administrator is troubleshooting a Pod in a Kubernetes cluster that is not starting. Which TWO kubectl commands are most useful for diagnosing the issue? (Choose TWO.)

Select 2 answers
A.kubectl get nodes
B.kubectl apply -f pod.yaml
C.kubectl delete pod <pod-name>
D.kubectl logs <pod-name>
E.kubectl describe pod <pod-name>
AnswersD, E

Retrieves logs from the container, useful for application errors.

Why this answer

kubectl describe pod provides detailed event and status information, and kubectl logs retrieves container logs.

Full explanation →
119
MCQmedium

A container is running a database service that requires persistent storage. The administrator wants to ensure that data persists even if the container is removed. Which volume mount type should be used in the Docker run command?

A.--mount type=volume
B.--mount type=bind
C.COPY in Dockerfile
D.--mount type=tmpfs
AnswerA

Volumes are the recommended way to persist data in Docker. They are managed by Docker and survive container removal.

Why this answer

Docker volumes are the preferred mechanism for persisting data generated by and used by Docker containers. Volumes are completely managed by Docker, are independent of the container lifecycle, and can be backed up easily. They persist even after the container is removed, making them ideal for database services.

While bind mounts (option B) also provide persistence by mapping a host directory, they are less portable and have security considerations. Since the question does not specify a need for host directory mapping, volumes are the recommended choice.

Exam trap

The trap is that candidates might think bind mounts are the only way to achieve persistence, but Docker volumes also persist data and are actually the recommended approach for persistent storage. The key is that volumes are managed by Docker and are more portable.

How to eliminate wrong answers

Option A is wrong because `--mount type=volume` creates a Docker-managed volume that persists data, but the question specifies the administrator wants data to persist even if the container is removed; while volumes also persist, the correct answer for the given scenario is bind mount, as the question implies a direct host path mapping. Option C is wrong because `COPY` in a Dockerfile only copies files into the image at build time, not at runtime, and does not provide persistent storage that survives container removal. Option D is wrong because `--mount type=tmpfs` mounts a temporary filesystem stored in memory, which is volatile and data is lost when the container stops or is removed.

Full explanation →
120
MCQeasy

A DevOps engineer needs to run a container that executes a batch job and then exits. The container image is stored in a private registry. Which Docker command should be used to run the container and automatically remove it after it exits?

A.docker run --rm private.registry.com/batch:latest
B.docker start --rm private.registry.com/batch:latest
C.docker run -d private.registry.com/batch:latest
D.docker exec --rm private.registry.com/batch:latest
AnswerA

The --rm flag ensures the container is removed after it exits, and the image is pulled from the registry.

Why this answer

The `docker run --rm` command automatically removes the container after it exits, which is ideal for batch jobs that should not leave behind stopped containers. The image reference `private.registry.com/batch:latest` pulls from a private registry when not cached locally. This combination ensures the container runs once, completes its task, and is cleaned up without manual intervention.

Exam trap

CompTIA often tests the distinction between `docker run` (creates and starts a new container) and `docker start` (restarts an existing container), and the trap here is that candidates may confuse `--rm` as a generic cleanup flag applicable to any Docker command, when it is only valid with `docker run`.

How to eliminate wrong answers

Option B is wrong because `docker start` only starts an existing stopped container; it cannot pull or run a new image from a registry, and `--rm` is not a valid flag for `docker start`. Option C is wrong because `docker run -d` runs the container in detached mode (background) and does not automatically remove it after exit; the container would remain as a stopped container. Option D is wrong because `docker exec` runs a command inside an already running container, not a new container from an image, and `--rm` is not a valid flag for `docker exec`.

Full explanation →
121
MCQhard

An administrator runs 'rpm -V httpd' and sees output like 'S.5....T. /etc/httpd/conf/httpd.conf'. What does this indicate?

A.The file has been deleted
B.The file has incorrect permissions
C.The file is corrupted
D.The file has been modified since installation
AnswerD

The letters indicate attributes that differ from the RPM database.

Why this answer

The rpm -V command verifies installed packages. The output shows that the file size, MD5 checksum, and modification time have changed from the package's original.

Full explanation →
122
Multi-Selecthard

An administrator is configuring sudo access for a group of developers. They should be able to run any command as root, but only after authenticating with their own password. Which TWO configuration lines in /etc/sudoers would achieve this? (Select TWO.)

Select 2 answers
A.Defaults:%developers !authenticate
B.root ALL=(ALL) ALL
C.%developers ALL=(ALL) NOPASSWD: ALL
D.%developers ALL=(ALL) ALL
E.%developers ALL=(ALL) PASSWD: ALL
AnswersD, E

Gives developers full sudo access with password prompt (default).

Why this answer

The syntax `%developers ALL=(ALL) ALL` grants members of the `developers` group permission to run any command as any user (including root) on any host, and by default sudo requires the user's own password for authentication. Option E is also correct because `PASSWD: ALL` explicitly enforces password authentication for all commands, overriding any global `!authenticate` or `NOPASSWD` settings. Together, these two lines ensure the developers must authenticate with their own password before executing commands as root.

Exam trap

The trap here is that candidates often confuse the default behavior of sudo (which requires a password) with the explicit `PASSWD` tag, and may incorrectly select `NOPASSWD` options or miss that `PASSWD: ALL` is needed to override potential global `!authenticate` settings or to make the requirement explicit.

Full explanation →
123
MCQhard

An administrator is troubleshooting a service that fails to start. The administrator wants to view the last 50 lines of the service's journal log entries from the current boot. Which journalctl command should be used?

A.journalctl -f -n 50 -u service
B.journalctl -u service --since today
C.journalctl -x -n 50 -u service
D.journalctl -u service -b -n 50
AnswerD

Correct.

Why this answer

journalctl -u service -b -n 50 shows entries for the unit (-u), from current boot (-b), last 50 lines (-n 50).

Full explanation →
124
MCQeasy

A Linux administrator needs to write a Bash script that runs a series of commands and stops immediately if any command fails. Which directive should be included at the beginning of the script?

A.#!/bin/bash
B.trap ... ERR
C.set -e
D.set -x
AnswerC

Correct. set -e exits on any command failure.

Why this answer

The 'set -e' directive causes the script to exit immediately if any command returns a non-zero exit status, which is useful for error handling.

Full explanation →
125
MCQeasy

Based on the exhibit, what is the most likely cause of the sshd service failure?

A.The SSH configuration file has a syntax error.
B.The privilege separation directory /var/empty/sshd does not exist.
C.The sshd PID file cannot be written.
D.The SSH port is already in use by another service.
AnswerB

The error message directly states this directory is missing.

Why this answer

The error message 'Privilege separation directory /var/empty/sshd does not exist' directly indicates that the required chroot directory for the unprivileged sshd process is missing. Without this directory, sshd cannot drop privileges after authentication, causing it to fail on startup. This is a common issue after a partial installation or cleanup of OpenSSH.

Exam trap

CompTIA often tests the specific error message 'Privilege separation directory /var/empty/sshd does not exist' to trap candidates who assume the failure is due to a configuration syntax error or port conflict, rather than recognizing the missing chroot directory as a distinct startup prerequisite.

How to eliminate wrong answers

Option A is wrong because a syntax error in the SSH configuration file would typically produce a specific parse error message (e.g., 'Bad configuration option' or 'line X: syntax error'), not a missing directory error. Option C is wrong because the inability to write the PID file would generate a 'Could not create PID file' or 'Permission denied' message, not a privilege separation directory error. Option D is wrong because if the SSH port were already in use, the error would be 'Address already in use' or 'bind: Address in use', which is a socket binding failure, not a missing directory.

Full explanation →
126
MCQhard

A Kubernetes administrator needs to expose a deployment named 'web-app' running on port 80 internally within the cluster. Which kubectl command creates a service of type ClusterIP that maps port 80 to the target port 8080 on the pods?

A.kubectl create service nodeport web-app --tcp=80:8080
B.kubectl expose deployment web-app --port=80 --target-port=8080
C.kubectl expose pod web-app --port=80 --target-port=8080
D.kubectl create service clusterip web-app --tcp=80:8080
AnswerB

Correct. This creates a Service targeting port 80 and forwarding to container port 8080.

Why this answer

To create a ClusterIP service, use 'kubectl expose deployment web-app --port=80 --target-port=8080'. The --type=ClusterIP is default.

Full explanation →
127
MCQmedium

A container named web2 exited with status 0. Which of the following is the most likely reason?

A.The container ran a task and completed
B.The container's entrypoint crashed
C.The container was stopped manually with docker stop
D.The container ran out of memory
AnswerC

docker stop sends SIGTERM, causing a clean exit with code 0.

Why this answer

Exit code 0 indicates a successful termination. When a container exits with status 0, it means the main process (entrypoint or command) completed its task without errors. Option C is correct because `docker stop` sends a SIGTERM signal to the container's PID 1, allowing it to shut down gracefully; if the process handles the signal and exits cleanly, the exit code will be 0.

Exam trap

The trap here is that candidates often assume exit code 0 always means the container completed its intended work, but CompTIA tests the nuance that a manual `docker stop` can also produce exit code 0 if the process handles the shutdown gracefully.

How to eliminate wrong answers

Option A is wrong because while a container that runs a task and completes will also exit with status 0, the question states the container was 'stopped manually with docker stop', which is the most likely reason given the explicit action. Option B is wrong because if the container's entrypoint crashed, it would typically exit with a non-zero status (e.g., 1, 2, or 139 for a segfault), not 0. Option D is wrong because running out of memory causes the container to be killed by the OOM killer, which results in exit code 137 (128 + 9, where 9 is SIGKILL), not 0.

Full explanation →
128
MCQmedium

The output of df -h shows the root filesystem at 100% capacity. Which of the following commands should the administrator run NEXT to identify the cause?

A.fdisk -l /dev/sda
B.fsck /dev/sda1
C.ls -la /
D.du -sh /*
AnswerD

Shows directory sizes to find space hogs.

Why this answer

The `du -sh /*` command calculates and displays the disk usage of each top-level directory in the root filesystem. When `df -h` shows 100% capacity, the next logical step is to identify which directories are consuming the most space, so the administrator can drill down further. This command is the standard tool for pinpointing space hogs before taking corrective action.

Exam trap

CompTIA often tests the distinction between listing files (`ls`) and measuring disk usage (`du`), trapping candidates who think `ls -la /` will reveal space consumption when it only shows metadata and not recursive sizes.

How to eliminate wrong answers

Option A is wrong because `fdisk -l /dev/sda` is used to list partition tables, not to identify which files or directories are consuming disk space; it provides no insight into filesystem usage. Option B is wrong because `fsck /dev/sda1` checks and repairs filesystem integrity, but running it on a mounted, full filesystem can cause data corruption and does not address the root cause of capacity exhaustion. Option C is wrong because `ls -la /` lists the contents of the root directory with metadata but does not aggregate sizes recursively, so it cannot show which subdirectories are using the most space.

Full explanation →
129
Multi-Selectmedium

A systems administrator is writing a bash script that must accept command-line options: -f for a configuration file, -v for verbose mode, and -d for a directory. Which TWO of the following are correct ways to parse these options using getopts? (Select TWO).

Select 2 answers
A.while getopts 'f v d' opt; do
B.while getopts 'f:vd' opt; do
C.while getopts ':f:vd:' opt; do
D.while getopts 'fv:d:' opt; do
E.while getopts 'f:vd:' opt; do
AnswersC, E

Leading colon suppresses error messages; same effect as A for option parsing.

Why this answer

getopts option string 'f:vd:' means -f requires an argument, -v is boolean, -d requires an argument. The colon after f and d indicates argument required.

Full explanation →
130
MCQeasy

What does the output in the exhibit indicate about the /etc/shadow file?

A.The file has an SELinux context.
B.The file is encrypted.
C.The file has an ACL applied.
D.The file is compressed.
AnswerA

The output format is standard for SELinux labels.

Why this answer

The output in the exhibit shows the SELinux context for the /etc/shadow file, which is indicated by the string 'system_u:object_r:shadow_t:s0' appended to the file's permissions. This is the SELinux security context, consisting of user, role, type, and sensitivity level. The `ls -Z` command displays this context, confirming that the file has an SELinux label applied.

Exam trap

The trap here is that candidates confuse the SELinux context (displayed by `ls -Z`) with file encryption or ACLs, because the output shows a colon-separated string that looks like an ACL or encrypted data, but it is actually the SELinux security label.

How to eliminate wrong answers

Option B is wrong because the /etc/shadow file stores password hashes, but the output shown is from `ls -Z`, which displays SELinux contexts, not encryption status; the file itself is not encrypted, only the password fields within it are hashed. Option C is wrong because an ACL (Access Control List) would be indicated by a '+' sign at the end of the permission string (e.g., `-rw-------+`), but the output shows a '.' (or no special character) after the permissions, meaning no ACL is applied. Option D is wrong because a compressed file would typically have a different extension (e.g., .gz, .xz) or be indicated by the `ls` output showing a different size or attribute, and the `ls -Z` output does not show any compression indicator.

Full explanation →
131
Multi-Selecthard

A security policy requires that containers run with minimal privileges. Which THREE measures should be implemented? (Select THREE.)

Select 3 answers
A.Use --security-opt seccomp=default
B.Mount host filesystem read-write
C.Run as non-root user
D.Expose all ports to host
E.Drop all Linux capabilities and add only required
AnswersA, C, E

The default seccomp profile restricts system calls, improving security.

Why this answer

The `--security-opt seccomp=default` flag applies the default seccomp (secure computing mode) profile, which restricts the system calls available to the container. This enforces the principle of least privilege by blocking dangerous syscalls (e.g., `mount`, `reboot`) while allowing necessary ones, reducing the attack surface without manual profile creation.

Exam trap

Candidates often think that 'minimal privileges' only means running as non-root, when in fact seccomp profiles and capability dropping are equally critical to enforce kernel-level restrictions and prevent syscall-based exploits.

Full explanation →
132
MCQmedium

What is the effect of the firewall rules shown?

A.Only SSH traffic to 192.168.1.10 is allowed; all other traffic is dropped.
B.Only SSH and loopback traffic are allowed; all other traffic is dropped.
C.All traffic on eth0 is allowed; loopback is allowed.
D.SSH and ICMP echo-request are allowed; all other traffic is dropped.
AnswerD

SSH and ICMP echo-request are allowed; all other traffic, including loopback traffic that is not SSH or ICMP echo-request, is dropped.

Why this answer

The firewall rules shown explicitly allow SSH (port 22) and ICMP echo-request (type 8) traffic while the final default rule drops all other traffic. This matches option D, as the rules do not permit any other protocols or services, including loopback traffic unless it is SSH or ICMP echo-request.

Exam trap

The trap here is that candidates often assume loopback traffic is implicitly allowed or that the rules apply to all interfaces, but the rules only apply to the INPUT chain on eth0 and do not include any explicit loopback allowance, so only the specified protocols are permitted.

How to eliminate wrong answers

Option A is wrong because it states only SSH traffic to 192.168.1.10 is allowed, but the rules also permit ICMP echo-request, not just SSH. Option B is wrong because it claims loopback traffic is allowed, but the rules do not include any explicit allow rule for loopback (lo) interface traffic; only SSH and ICMP echo-request are permitted. Option C is wrong because it says all traffic on eth0 is allowed, but the rules include a default drop rule that denies all traffic not matching the SSH or ICMP echo-request allow rules.

Full explanation →
133
MCQeasy

A Docker container is running in the background. Which command allows the administrator to execute an interactive bash shell inside the running container named 'webapp'?

A.docker start -i webapp
B.docker run -it webapp bash
C.docker exec -it webapp bash
D.docker attach webapp
AnswerC

Correct. Exec runs a command interactively in the running container.

Why this answer

docker exec -it runs an interactive command in a running container. The other commands are for different purposes.

Full explanation →
134
MCQmedium

An administrator needs to deploy a containerized web application on a Linux server. The application requires port 8080 to be mapped to host port 80. Which command will run the container in detached mode with this port mapping?

A.docker run -p 80:8080 webapp
B.docker run -d -p 8080:80 webapp
C.docker run -d -p 80:80 webapp
D.docker run -d -p 80:8080 webapp
AnswerD

Correct: -d runs detached, -p 80:8080 maps host port 80 to container port 8080 as required.

Why this answer

The `-d` flag runs the container in detached mode, and `-p 80:8080` maps host port 80 to container port 8080, matching the requirement. Option D achieves this. Option A is missing the `-d` flag, so it would run in the foreground.

Option B uses `-p 8080:80`, which maps host port 8080 to container port 80—the reverse of what is needed. Option C uses `-p 80:80`, which does not expose the container's port 8080. The correct syntax is `-p host_port:container_port`.

Exam trap

The trap here is that candidates often confuse the order of port mapping in the `-p` flag, mistakenly thinking `-p container_port:host_port` is correct, when the correct syntax is `-p host_port:container_port`. Additionally, option C may be misinterpreted as correct because it maps port 80 on both host and container, but the requirement is to map the container's port 8080 to host port 80.

How to eliminate wrong answers

Option A is wrong because it omits the `-d` flag, so the container runs in the foreground (attached mode), not detached. Option B is wrong because it uses `-p 8080:80`, which maps host port 8080 to container port 80, reversing the required mapping (the application listens on container port 8080, not 80). Option C is identical to Option B and is wrong for the same reason: it incorrectly maps host port 8080 to container port 80.

Full explanation →
135
MCQmedium

A security auditor notices that a service account's password never expires. The company policy requires password rotation every 60 days. Which command will enforce this policy for the service account?

A.chage -W 7 serviceacct
B.usermod -e 60 serviceacct
C.chage -M 60 serviceacct && chage -d 0 serviceacct
D.passwd -n 60 serviceacct
AnswerC

This sets max age and forces immediate password change.

Why this answer

chage -M 60 sets the maximum password age to 60 days. To also force a password change on next login, use -d 0.

Full explanation →
136
MCQhard

A system administrator notices that a cron job runs every 5 minutes but should run only on weekdays. The current crontab entry is: */5 * * * * /usr/local/bin/script.sh. Which change to the time fields will restrict execution to Monday through Friday?

A.*/5 9-17 * * 1-5 /usr/local/bin/script.sh
B.*/5 * * * 1-6 /usr/local/bin/script.sh
C.*/5 * * * 1-5 /usr/local/bin/script.sh
D.5 * * * 1-5 /usr/local/bin/script.sh
AnswerC

Runs every 5 minutes, every hour, every day of month, every month, on weekdays (1-5).

Why this answer

The fifth field in a crontab entry specifies the day of the week, where 1 represents Monday and 5 represents Friday. By setting this field to `1-5`, the cron job will only execute on weekdays, while the `*/5` in the minute field ensures it still runs every 5 minutes. The other fields remain as `*` to allow execution at any hour and any day of the month.

Exam trap

The trap here is that candidates may confuse the day-of-week field with the day-of-month field, or incorrectly assume that `1-5` excludes weekends without realizing that cron's day-of-week numbering starts with Sunday as 0, so `1-5` correctly maps to Monday-Friday.

How to eliminate wrong answers

Option A is wrong because it adds a range `9-17` in the hour field, which restricts execution to business hours (9 AM to 5 PM) instead of only weekdays, and this is not required by the question. Option B is wrong because it uses `1-6` for the day-of-week field, which includes Saturday (6) in addition to weekdays, causing the job to run on Saturdays as well. Option D is wrong because it changes the minute field from `*/5` to `5`, meaning the job would run only at minute 5 of every hour, not every 5 minutes, thus altering the frequency requirement.

Full explanation →
137
MCQeasy

A junior administrator writes a bash script to check disk usage and send an email alert. The script runs manually but does not execute from cron. Which of the following is the most likely cause?

A.Script not marked executable
B.Incorrect file permissions on cron job
C.Missing shebang line
D.Absolute path not specified in crontab
AnswerD

Cron runs with a minimal PATH; without a full path to the script, the job will not find it.

Why this answer

When a script runs manually from the command line but fails from cron, the most common cause is that cron does not inherit the user's PATH environment. Without an absolute path to the script in the crontab entry, cron cannot locate the script. Option D directly addresses this: specifying the full path (e.g., /home/user/script.sh) ensures cron can find and execute it.

Exam trap

CompTIA often tests the misconception that cron failures are due to file permissions or missing shebangs, when the real issue is the restricted cron environment—specifically the lack of an absolute path or a missing PATH variable.

How to eliminate wrong answers

Option A is wrong because if the script were not marked executable, it would also fail when run manually from the command line (unless invoked with 'bash script.sh'), but the question states it runs manually. Option B is wrong because cron jobs themselves are not files with permissions; the cron table (crontab) is a configuration file, and its permissions (typically 600 owned by the user) are not the issue—the script's permissions or cron's environment are. Option C is wrong because a missing shebang line would cause the script to fail regardless of how it is invoked (manual or cron), but the script runs manually, so a shebang is present or the shell is explicitly specified.

Full explanation →
138
MCQhard

An AppArmor profile for a web server is in complain mode. After testing, the administrator wants to enforce the profile. Which command accomplishes this?

A.apparmor_parser -r /etc/apparmor.d/usr.sbin.httpd
B.aa-enforce /etc/apparmor.d/usr.sbin.httpd
C.aa-complain /etc/apparmor.d/usr.sbin.httpd
D.aa-status /etc/apparmor.d/usr.sbin.httpd
AnswerB

Correct command.

Why this answer

The correct command to enforce an AppArmor profile that is currently in complain mode is `aa-enforce`. This command switches the profile from complain (log-only) to enforce (block violations) mode. The option `-r` in `apparmor_parser` reloads the profile but does not change its mode; `aa-complain` sets it to complain mode, and `aa-status` only displays status.

Exam trap

The trap here is that candidates confuse `apparmor_parser -r` (which reloads the profile but does not change its mode) with the mode-switching commands `aa-enforce` and `aa-complain`, leading them to choose option A incorrectly.

How to eliminate wrong answers

Option A is wrong because `apparmor_parser -r` reloads the profile from disk but does not change its operational mode; it would reload the profile in its current mode (complain), not enforce. Option C is wrong because `aa-complain` sets the profile to complain mode, which is the opposite of what the administrator wants. Option D is wrong because `aa-status` is used to display the status of loaded AppArmor profiles, not to change their enforcement mode.

Full explanation →
139
Multi-Selectmedium

A Linux administrator is writing a bash script to process a list of usernames stored in an array. The script must iterate over each username and print a welcome message. Which TWO of the following loops will correctly iterate over the array 'users' and print 'Welcome, <username>'? (Choose TWO.)

Select 2 answers
A.for user in $users; do echo "Welcome, $user"; done
B.for user in "${users[*]}"; do echo "Welcome, $user"; done
C.while read user; do echo "Welcome, $user"; done < <(printf '%s\n' "${users[@]}")
D.for ((i=0; i<${#users[@]}; i++)); do echo "Welcome, ${users[$i]}"; done
E.for user in ${users[@]}; do echo "Welcome, $user"; done
AnswersD, E

Correct. Uses C-style for loop with array length and indexing.

Why this answer

Arrays can be iterated using for with ${users[@]} or using indices. The correct methods are direct iteration over elements and using a C-style for loop with indices.

Full explanation →
140
Multi-Selecthard

A database server running on Linux is experiencing high load. The administrator runs 'strace -p <pid>' and sees many 'epoll_wait' and 'futex' calls. Which THREE of the following are possible causes of the high load? (Choose THREE.)

Select 3 answers
A.Disk I/O contention causing processes to wait.
B.A large number of concurrent connections.
C.CPU frequency scaling is set to powersave.
D.A memory leak in the database process.
E.Inefficient database queries causing high CPU usage.
AnswersA, B, E

Waiting on I/O increases load average as processes are in uninterruptible sleep.

Why this answer

'epoll_wait' indicates the process is waiting for I/O events, and 'futex' calls are used for synchronization. Disk I/O contention can cause the database process to block on these system calls, leading to high load as the kernel schedules other tasks while waiting for I/O to complete.

Exam trap

The trap here is that candidates may incorrectly associate 'futex' calls solely with memory issues or CPU scaling, rather than recognizing them as indicators of thread contention and I/O waiting under high concurrency.

Full explanation →
141
MCQeasy

A Linux administrator needs to ensure that user passwords expire after 90 days. Which command should be used to enforce this policy?

A.chage -M 90 username
B.passwd -x 90 username
C.passwd -e 90 username
D.usermod -e 90 username
AnswerA

chage -M sets the maximum password age in days.

Why this answer

The `chage -M 90 username` command sets the maximum number of days a password is valid before it must be changed, enforcing a 90-day expiration policy. This directly modifies the `PASS_MAX_DAYS` field in `/etc/shadow` for the specified user, which the system checks during authentication.

Exam trap

The trap here is that candidates confuse `passwd -x` (which does set max days but is less commonly used and not the recommended tool for policy enforcement) with `chage -M`, or they misremember `usermod -e` as password aging when it actually controls account expiry.

How to eliminate wrong answers

Option B is wrong because `passwd -x 90 username` is not a valid syntax; the `passwd` command uses `-x` to set the maximum password age, but it requires a numeric argument and the correct form is `passwd -x 90 username` (note: this is actually valid on some systems, but the XK0-005 exam expects `chage` as the standard tool for aging policies). Option C is wrong because `passwd -e 90 username` is invalid; `passwd -e` forces password expiration immediately (sets the last change date to 0), not a 90-day interval. Option D is wrong because `usermod -e 90 username` sets the account expiration date (in YYYY-MM-DD format), not the password aging policy.

Full explanation →
142
MCQhard

A container needs to communicate with a database on the host machine using the default bridge network. The container cannot resolve the host by hostname. Which approach should be used?

A.Set --net=host
B.Use --link db:db
C.Create a custom bridge network
D.Use --add-host host.docker.internal:host-gateway
AnswerD

This adds a host entry that resolves to the host's IP via the gateway, allowing the container to reach host services.

Why this answer

`--add-host host.docker.internal:host-gateway` adds a special entry to the container's `/etc/hosts` file that resolves `host.docker.internal` to the host machine's gateway IP address, which on the default bridge network is the host itself. This allows the container to reach the host by a consistent hostname without relying on Docker's internal DNS, which does not resolve hostnames on the default bridge. The `host-gateway` magic value automatically maps to the host's IP (typically 172.17.0.1 on Linux).

Exam trap

The trap here is that candidates often confuse `--net=host` as a quick fix for hostname resolution, not realizing it sacrifices network isolation and is not the intended method for reaching the host from a container on the default bridge.

How to eliminate wrong answers

Option A is wrong because `--net=host` removes network isolation entirely, making the container share the host's network stack, which is overly permissive and not a targeted solution for hostname resolution. Option B is wrong because `--link` is a legacy feature that provides name resolution between containers, not between a container and the host machine. Option C is wrong because creating a custom bridge network enables automatic DNS resolution for container names, but it does not automatically provide a hostname for the host machine; you would still need to use `--add-host` or similar to resolve the host by name.

Full explanation →
143
Multi-Selectmedium

A Linux administrator suspects a memory leak in a process. Which TWO commands can be used to monitor memory usage over time for a specific process? (Choose two.)

Select 2 answers
A.top
B.vmstat
C.iostat
D.ps aux --sort=-%mem
E.free
AnswersA, D

top shows real-time memory usage per process in the RES and VIRT columns.

Why this answer

(top) is correct because it provides a real-time, interactive view of system processes, including memory usage (RES, VIRT, %MEM) that updates by default every 3 seconds. You can filter by PID to monitor a specific process over time, making it ideal for detecting memory growth patterns indicative of a leak.

Exam trap

The trap here is that candidates may think vmstat or free can monitor per-process memory, but they only show aggregate system memory, while top and ps are the correct tools for per-process memory tracking over time.

Full explanation →
144
MCQeasy

A company needs to verify that the Apache HTTP server is running and see its current status along with recent log entries. Which command should be used?

A.systemctl status httpd
B.service httpd status
C.journalctl -u httpd
D.systemctl list-units --type=service
AnswerA

Correct: Displays service status and recent log entries.

Why this answer

The `systemctl status httpd` command is correct because it provides a comprehensive view of the Apache HTTP server's current state (active/inactive), its process ID, memory usage, and the most recent log entries from the service's journal. This aligns with the question's requirement to both verify the service is running and see its status along with recent log entries, all in a single command output.

Exam trap

The trap here is that candidates often confuse `systemctl status` with `journalctl -u`, thinking both provide the same information, but `journalctl` lacks the live status and process details that `systemctl status` includes.

How to eliminate wrong answers

Option B is wrong because `service httpd status` is a legacy SysVinit command that only shows the service's running state (e.g., 'httpd is running') without displaying recent log entries or detailed status information. Option C is wrong because `journalctl -u httpd` shows only the log entries for the httpd unit but does not display the current running status or process details; it requires a separate command to verify if the service is active. Option D is wrong because `systemctl list-units --type=service` lists all loaded service units and their states but does not filter to httpd specifically, nor does it show recent log entries or detailed status for a single service.

Full explanation →
145
MCQhard

A company policy requires all systems to have a specific set of security patches applied. The administrator needs to generate a report listing all installed packages that contain security updates available. Which command sequence should be used on Red Hat-based systems?

A.yum check-update
B.yum updateinfo list security
C.yum info-sec
D.yum list-security
E.yum list updates
AnswerD

Lists security-related updates.

Why this answer

`yum list-security` is the specific command on Red Hat-based systems that lists all installed packages for which security updates are available. This directly satisfies the requirement to generate a report of installed packages with available security patches, as mandated by company policy.

Exam trap

The trap here is that candidates confuse `yum updateinfo list security` (which shows advisory metadata) with `yum list-security` (which lists installed packages with security updates), leading them to choose option B instead of D.

How to eliminate wrong answers

Option A is wrong because `yum check-update` lists all available package updates, not just security updates, so it does not filter for security-specific patches. Option B is wrong because `yum updateinfo list security` displays advisory information about security updates but does not list the installed packages themselves; it shows metadata like CVE IDs and severity. Option C is wrong because `yum info-sec` is not a valid yum command; the correct syntax uses `yum updateinfo` or `yum list-security`.

Option E is wrong because `yum list updates` is not a valid yum command; the correct command to list all updates is `yum list updates` (with 'updates' as a repository) but it does not filter for security updates.

Full explanation →
146
MCQmedium

Based on the exhibit, which statement is true about the sshd service?

A.The service is masked.
B.The service is inactive.
C.The service has exited.
D.The service is not enabled to start at boot.
AnswerD

'disabled' indicates the service is not enabled for automatic start.

Why this answer

The exhibit shows the output of `systemctl status sshd.service`. The line `Loaded: loaded (/usr/lib/systemd/system/sshd.service; disabled; vendor preset: enabled)` indicates the service is currently loaded but its enablement state is `disabled`, meaning it is not configured to start automatically at boot. The `Active: active (running)` line with a PID confirms the service is currently running, but the question asks about boot-time behavior, which is governed by the `disabled` state.

Therefore, option D is correct.

Exam trap

The trap here is that candidates see `Active: active (running)` and incorrectly assume the service is enabled to start at boot, but the actual evidence for boot behavior is the `disabled` keyword in the Loaded line, not the Active line.

How to eliminate wrong answers

Option A is wrong because the service is `loaded`, not `masked`; a masked service would show `masked` in the Loaded line and cannot be started directly. Option B is wrong because while the service is currently `inactive (dead)`, the question asks for a true statement about the service overall, and the key fact is its disabled boot status, not just its current runtime state. Option C is wrong because `exited` is a specific active state for services that run and terminate (e.g., oneshot type), but this service shows `inactive (dead)`, not `exited`; `exited` would appear as `Active: active (exited)`.

Full explanation →
147
MCQmedium

A system administrator is configuring a firewall using iptables. The requirement is to allow incoming SSH connections from the 192.168.1.0/24 network only. Which iptables rule should be added to the INPUT chain?

A.iptables -A INPUT -p tcp --dport 22 -d 192.168.1.0/24 -j ACCEPT
B.iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j REJECT
C.iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
D.iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j LOG
E.iptables -A INPUT -p tcp --dport 22 -j ACCEPT
AnswerC

Allows SSH from the specified network.

Why this answer

It uses the `-s` (source) flag to specify the 192.168.1.0/24 network, ensuring only incoming SSH traffic (TCP port 22) from that subnet is accepted. The `-A INPUT` appends this rule to the INPUT chain, which processes incoming packets destined for the local system. This matches the requirement exactly.

Exam trap

The trap here is confusing the `-s` (source) and `-d` (destination) flags, leading candidates to choose option A, which would allow SSH traffic destined for the 192.168.1.0/24 network instead of traffic originating from it.

How to eliminate wrong answers

Option A is wrong because it uses `-d` (destination) instead of `-s` (source), which would match packets destined for the 192.168.1.0/24 network rather than originating from it, allowing SSH from any source to that subnet. Option B is wrong because it uses `-j REJECT` instead of `-j ACCEPT`, which would block SSH from the 192.168.1.0/24 network, contrary to the requirement. Option D is wrong because it uses `-j LOG`, which only logs matching packets without accepting or rejecting them, so SSH connections would not be allowed.

Option E is wrong because it lacks a source restriction, allowing incoming SSH from any IP address, not just the 192.168.1.0/24 network.

Full explanation →
148
MCQeasy

A Linux administrator writes a bash script that needs to exit immediately if any command fails. Which of the following should be included at the beginning of the script?

A.set -x
B.set -u
C.set -e
D.set -o pipefail
AnswerC

set -e exits the script on any command failure.

Why this answer

The 'set -e' command causes the shell to exit if any command exits with a non-zero status, which is useful for error handling.

Full explanation →
149
Multi-Selecteasy

A Linux administrator writes a Python script to parse configuration files. Which TWO practices improve security and portability? (Select TWO.)

Select 2 answers
A.Validate all external input before processing
B.Use absolute paths for all file operations
C.Use sudo within the script to run privileged commands
D.Use raw_input() instead of input() in Python 2
E.Use shebang #!/usr/bin/env python3
AnswersA, E

Input validation prevents injection attacks and improves security.

Why this answer

Validating all external input before processing prevents injection attacks and data corruption. In Python, this means checking file paths, user inputs, and configuration values against expected patterns (e.g., using regex or allowlists) before using them in file operations or system calls. This is a core security principle for any script that handles untrusted data.

Exam trap

Another common mistake is selecting Option B because absolute paths seem more reliable, but they actually harm portability when the script is moved to a different system with a different directory structure.

Full explanation →
150
Multi-Selecteasy

A technician is troubleshooting a user's inability to execute a script. The script has execute permissions for the user. Which of the following could be causing the issue? (Choose two.)

Select 2 answers
A.The user is not the owner
B.The script has a syntax error
C.The script is being blocked by a firewall
D.The script is in a directory without execute permission
E.The script's SELinux context is incorrect
AnswersD, E

Directories need execute permission for users to traverse.

Why this answer

Even if the script file itself has execute permissions, the user must also have execute permission on the directory containing the script. The directory's execute bit (often called the 'search' bit) is required to traverse the directory and access files within it. Without it, the kernel will deny access to any file in that directory, regardless of the file's own permissions.

Exam trap

The trap here is that candidates focus solely on the file's execute permission and overlook the directory's execute permission, or they confuse SELinux context errors with simple permission issues.

Full explanation →
Page 1

Page 2 of 14

Page 3

All pages

1234567891011121314

Practice XK0-006 by domain

Target a specific domain to shore up weak areas.

Services and User ManagementSecurityTroubleshootingAutomation, Orchestration, and ScriptingSystem Management
See all domains with question counts →