CompTIA Linux+ (XK0-006) (XK0-006) — Questions 151–225

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because /etc/rsyslog.conf is the configuration file for the rsyslog daemon itself, which handles log generation and forwarding, not log rotation; rsyslog does not support a 'rotate' directive in its configuration syntax. Option C is wrong because /etc/systemd/journald.conf configures systemd-journald, which manages binary journal logs, not traditional text log files, and its 'MaxRetentionSec' and 'Compress' settings control journal retention and compression, not rotation of text-based log files like /var/log/syslog. Option D is wrong because while the logrotate cron job does exist at /etc/cron.daily/logrotate, simply calling 'logrotate -f' forces an immediate rotation but does not configure the rotation parameters (weekly, rotate 4, compress, delaycompress); those settings must be defined in a configuration file under /etc/logrotate.d/.

Why this answer

How to eliminate wrong answers

Option B is wrong because `systemctl status httpd --full` shows the current status and recent log lines of the service, but it does not provide the detailed failure reason from the journal; it only truncates output lines to full width, not the cause. Option C is wrong because `tail -f /var/log/httpd/access_log` tails the HTTP access log, which records client requests, not service failure reasons; the relevant log for failures is typically `/var/log/httpd/error_log`. Option D is wrong because `dmesg | grep httpd` searches kernel ring buffer messages, which are for hardware/driver issues and kernel panics, not for user-space service failures like an httpd crash.

Why this answer

How to eliminate wrong answers

Option A is wrong because modprobe loads a module at runtime, but the issue occurs during boot before the root filesystem is mounted; the module must be present in the initramfs to be loaded early. Option C is wrong because udev rules handle device naming and permissions after the kernel has detected the hardware, but they do not cause the kernel to fail to detect the NIC; the problem is that the module is not loaded at all. Option D is wrong because reinstalling the kernel package would simply reapply the same kernel files; it does not rebuild the initramfs, which is the specific step needed to include the updated module.

Why this answer

How to eliminate wrong answers

Option B is wrong because `lsblk` lists block devices (e.g., disks and partitions) and their attributes, but it does not show disk space usage or available capacity in human-readable format. Option C is wrong because `du -h` estimates file and directory space usage, not the total disk space used and available on mounted filesystems. Option D is wrong because `fdisk -l` displays partition table information for block devices, not current filesystem usage or available space.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `systemctl status sshd.service` shows the current state and recent log tail, but it may not show the full historical log output needed to diagnose a failure that occurred earlier. Option B is wrong because `systemctl restart sshd.service` attempts to restart the service without first understanding why it failed, which could mask the underlying issue or cause repeated failures. Option D is wrong because `systemctl list-units` lists all loaded units and their states, but it does not provide any diagnostic details about why a specific service like sshd failed.

Why this answer

How to eliminate wrong answers

Option A is wrong because `kernel.panic_on_warn` controls whether the kernel panics on a warning (WARN()), not the reboot behavior after a panic; setting it to 10 would be invalid as it expects 0 or 1. Option B is wrong because `kernel.panic_on_oops` determines if the kernel panics on an oops (a non-fatal error), not the timeout before reboot; it also expects a boolean value (0 or 1), not 10. Option C is wrong because `kernel.panic_print` controls the verbosity of kernel messages printed during a panic, not the reboot action or delay.

Why this answer

How to eliminate wrong answers

Option B is wrong because SSH rules (typically port 22) do not block HTTP traffic; iptables rules are evaluated sequentially, and an SSH rule would only affect SSH packets, not HTTP packets on port 80. Option C is wrong because the loopback interface (lo) is used for local communication within the host, not for external internet traffic; its ACCEPT or DROP status does not affect inbound HTTP connections from the internet. Option D is wrong because the default INPUT policy being DROP would only apply to packets that do not match any existing rule; if the HTTP rule were correctly allowing all sources, the default policy would not block internet traffic, but here the HTTP rule itself restricts the source, so the issue is the rule's source limitation, not the default policy.

Why this answer

How to eliminate wrong answers

Option A is wrong because changing the directory's group to include the user does not grant the user write permission on the directory (755 gives group read+execute only) and does not override the sticky bit restriction; the user would still need directory write and the sticky bit would still block deletion. Option C is wrong because adding write permission for others on the file (chmod o+w) does not affect deletion; deletion is controlled by directory permissions and the sticky bit, not file permissions. Option D is wrong because changing the file's group to match the user's group does not give the user write permission on the directory or bypass the sticky bit; the user still cannot delete the file unless they own it or have directory write and the sticky bit is removed.

Why this answer

How to eliminate wrong answers

Option B is wrong because using a non-LTS base image is not inherently a best practice violation; it may be acceptable for testing or specific requirements, and the question focuses on Dockerfile layering and caching, not base image choice. Option C is wrong because not using a .dockerignore file is a best practice for reducing build context size and preventing unintended files from being copied, but it is not the specific violation demonstrated by the given Dockerfile (which lacks combined apt commands). Option D is wrong because while running `apt-get update` without cache cleanup (e.g., `rm -rf /var/lib/apt/lists/*`) is a best practice to reduce image size, the primary violation in the exhibit is the separation of update and install into different RUN commands, not the absence of cleanup.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the default network driver for Docker Compose is 'bridge', not 'host'; using 'host' would bypass Docker's DNS and cause different connectivity issues. Option C is wrong because the error message 'getaddrinfo EAI_AGAIN backend-service' indicates a DNS resolution failure, not a port mismatch; a port issue would produce a connection refused or timeout error. Option D is wrong because Docker's embedded DNS resolver does not cache IP addresses in a way that would cause an `EAI_AGAIN` error; it uses a short TTL and stale entries would result in a different error (e.g., connection timeout) or a successful resolution to an old IP.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because CPU utilization is 90% idle, meaning the CPU is not overloaded; upgrading the CPU would not resolve I/O-bound waits. Option B is wrong because network interface saturation would manifest as high network I/O wait or dropped packets, not as a high run queue with idle CPU; 'sar -q' does not measure network congestion. Option C is wrong because low memory and heavy swapping would show high %system or %iowait due to swap I/O, but the primary symptom here is a high load average with idle CPU, which is classic for disk I/O bottlenecks, not memory pressure alone.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because 'dmesg' displays kernel ring buffer messages, which are primarily for hardware, driver, and kernel-level issues, not for application-level service failures like a process exiting with a non-zero code. Option C is wrong because 'ps aux | grep myapp' checks for currently running processes, but since the service has already failed and exited, this command will not show the failed process or provide any information about why it failed. Option D is wrong because editing the service file to increase timeout values is a premature corrective action taken without first diagnosing the root cause; the failure is due to an exit code, not a timeout, so this would not address the actual problem.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the DROP rule is added first, which would drop all incoming SSH traffic before the ACCEPT rule for 192.168.1.0/24 is evaluated, effectively blocking all SSH connections including from the allowed subnet. Option C is wrong because it only drops SSH traffic from the 10.0.0.0/8 subnet, leaving SSH traffic from all other sources (including the default ACCEPT policy) unrestricted, which does not restrict SSH to only 192.168.1.0/24. Option D is wrong because it inserts the DROP rule at the beginning of the INPUT chain using -I, which would drop all SSH traffic before the ACCEPT rule is evaluated, similar to option A, and also fails to restrict access to only the specified subnet.

Why this answer

How to eliminate wrong answers

Option B is wrong because the user mount option allows any user to mount the filesystem, which does not preserve user ownership of files; it also uses LABEL=DATA without ensuring the label exists, and the pass value 2 is fine but the dump value 0 is acceptable, but the core issue is the user option does not enforce ownership. Option C is wrong because uid=1000 is not a valid mount option for ext4; filesystem ownership is managed via chown or user mapping, not a mount option, and UUID=xxxx is a placeholder but the uid option is invalid. Option D is wrong because the pass value 0 means the filesystem will not be checked at boot (fsck skipped), which is not recommended for a non-root ext4 filesystem; also, it lacks the auto option explicitly, though defaults would include it, but the missing dump and pass values are incorrect.

Why this answer

How to eliminate wrong answers

Option A is wrong because if the destination host were down, the local system would typically receive an ICMP Destination Unreachable (Host Unreachable) message from the last-hop router, not a simple timeout, unless the router also lacks a route. Option B is wrong because a missing default gateway would prevent any outbound traffic, causing all pings to fail with 'Destination host unreachable' at the local system, not a timeout after multiple hops. Option C is wrong because a routing loop causes packets to circulate indefinitely until TTL expires, which would generate ICMP Time Exceeded messages and potentially show varying TTL values in ping output, not consistent timeouts without any response.

Why this answer

How to eliminate wrong answers

Option A is wrong because `PasswordAuthentication yes` enables password authentication, which is the opposite of the required change to disable it. Option B is wrong because `PubkeyAuthentication no` disables public key authentication, which would prevent key-based login entirely, contradicting the goal of using key-based authentication. Option D is wrong because `ChallengeResponseAuthentication yes` enables challenge-response authentication (often used with PAM), which can still allow password-based methods and does not directly disable password authentication.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `DenyGroups sshusers` would block users in the 'sshusers' group from SSH access, which is the opposite of what is required. Option C is wrong because `AllowUsers sshusers` specifies a username, not a group; it would only allow a user literally named 'sshusers' to log in, not all members of the group. Option D is wrong because `Subsystem sftp /usr/lib/openssh/sftp-server` configures the SFTP subsystem and has no effect on restricting SSH access based on group membership.

Why this answer

How to eliminate wrong answers

Option B is wrong because inserting the rule at position 5 places it after the default DROP rule (Rule 4), making it unreachable and ineffective — any packet from 203.0.113.5 would already be dropped by Rule 4 before reaching the new rule. Option C is wrong because appending with `-A` adds the rule at the end of the chain, after the default DROP rule, so it would never be evaluated and would not block the IP. Option D is wrong because it uses `-j ACCEPT` instead of `-j DROP`, which would explicitly allow all traffic from 203.0.113.5, defeating the security objective and potentially exposing the server to further attacks.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 'fs.file-max' in /etc/sysctl.conf sets the system-wide kernel limit on open files, not the per-user limit; even if this is high, users are still constrained by their per-user limits from PAM. Option B is wrong because adding 'session required pam_limits.so' to /etc/pam.d/login enables PAM's limits module but does not itself set any file descriptor values; it only activates the mechanism that reads limits.conf. Option C is wrong because running 'ulimit -n 65536' in a startup script only changes the limit for the current shell session and its child processes, and it is not persistent across reboots or inherited by other users' sessions.

Why this answer

How to eliminate wrong answers

Option A is wrong because the script is already scheduled in root's crontab, implying it is owned and executed by root; if it were not executable, cron would typically log an error, not produce no output. Option B is wrong because checking syslog for cron execution messages would only confirm whether cron launched the job, but the problem states the script runs (the job is scheduled) yet produces no output—syslog won't reveal why the script itself fails. Option C is wrong because adding a MAILTO directive sends cron's stdout/stderr via email, but if the script produces no output (e.g., it exits silently before any echo), MAILTO will send an empty message, providing no diagnostic information about the failure.

Why this answer

How to eliminate wrong answers

Option A is wrong because `chmod a+x script.sh` adds execute permission for all (a) — user, group, and others — which grants more permissions than required. Option B is wrong because `chmod 755 script.sh` sets permissions to rwxr-xr-x, which gives execute to owner, group, and others, not just the owner. Option D is wrong because `chmod 744 script.sh` sets permissions to rwxr--r--, which gives execute to the owner but also changes the owner's read/write permissions to read/write/execute (which is acceptable) and leaves group and others unchanged; however, it is not the minimal command (it explicitly sets all bits rather than just adding execute) and could inadvertently change other permissions if the original permissions were different, making it less precise than `chmod u+x`.

Why this answer

How to eliminate wrong answers

Option A is wrong because copying logs to a bind mount after they are written is not a native Docker approach; bind mounts rely on host directory paths and do not automatically persist logs if the container is removed without explicit copying. Option B is wrong because setting the log driver to syslog sends logs to the system's syslog service, but this does not guarantee persistence of the log file at /var/log/app.log within the container; it changes the output destination, not the file storage. Option C is wrong because redirecting logs to stdout and using docker logs only captures logs in the container's stdout stream, which is ephemeral and lost when the container is removed; docker logs does not provide persistent file storage.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because the single-bracket [ ... ] is a POSIX-compliant test command that invokes an external process or built-in with more overhead and is less efficient than [[ ... ]] in Bash. Option B is wrong because test is the same as single-bracket syntax, just written differently; it is not the most efficient Bash-specific syntax and still lacks the performance benefits of [[ ... ]]. Option C is wrong because ( -r /etc/myapp.conf ) uses parentheses to create a subshell, which is not a valid test construct for file readability; it will cause a syntax error or unexpected behavior.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because systemd-journald is designed for capturing systemd service logs, not for rotating existing log files written directly by an application; it does not handle files like /var/log/app/access.log, and MaxRetentionSec only controls journal retention, not file rotation. Option B is wrong because moving logs and restarting the application every hour would cause unnecessary application downtime and potential data loss, and it is not a built-in automated solution like logrotate. Option D is wrong because without copytruncate, logrotate would attempt to rename or move the log file, which would cause the application to continue writing to the old file (since it never closes its file handles), leading to lost logs and no rotation; weekly rotation is also too infrequent for a server running out of disk space frequently.

Why this answer

How to eliminate wrong answers

Option A is wrong because pam_faillock is used to lock user accounts after a specified number of failed login attempts, not to enforce password history or reuse restrictions. Option B is wrong because pam_pwquality is used to enforce password complexity requirements (e.g., length, character classes) and does not track or prevent reuse of previous passwords. Option C is wrong because pam_unix handles traditional Unix authentication, password updates, and shadow password management, but it does not have built-in support for password history tracking; that functionality is delegated to pam_pwhistory.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a misconfigured virtual host causing memory leaks would manifest as steadily increasing memory consumption over time, not necessarily as high swap usage; while it could contribute, the direct symptom of high swap points to a physical memory shortage rather than a leak. Option C is wrong because network congestion would cause packet loss, retransmissions, or high latency on the network interface, not high swap usage in system memory statistics. Option D is wrong because excessive CPU load from a runaway process would be visible in CPU utilization metrics (e.g., via top or uptime), not directly in swap usage; high swap can occur with low CPU load if memory is the bottleneck.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because manual triggering defeats the purpose of automation and does not scale for a development team pushing multiple commits. Option C is wrong because a GitHub webhook requires the Jenkins server to be reachable from the internet to receive the POST request, which is explicitly blocked by the firewall. Option D is wrong because the Git repository is hosted on GitHub (a cloud service), not on a local Git server; a cron job on the Git server is not possible when the server is not under the team's control.

Why this answer

Why this answer

Why this order

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `./test.sh` runs the script as an executable, which causes the kernel to fork a new subshell (based on the shebang) to execute the commands; the script does not run in the current shell. Option B is wrong because `sh test.sh` explicitly invokes the Bourne shell as a new process, forking a subshell that runs the script independently of the current shell. Option C is wrong because `bash test.sh` similarly launches a new Bash process as a subshell, isolating any environment changes from the parent shell.

Why this answer

How to eliminate wrong answers

Option A is wrong because it lacks the `--permanent` flag, so the rule only applies to the runtime configuration and will be lost after a firewall reload or reboot. Option B is wrong because the syntax is invalid: `--service` is not a valid option, and the flags are in the wrong order; the correct syntax is `--add-service` followed by the service name. Option C is wrong because while it uses the correct `--permanent` and `--zone` flags, it specifies a port number instead of the service name; using the service name is preferred for clarity and ensures the correct protocol (TCP) is applied, as HTTPS always uses TCP.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing AIDE verbosity only shows which attributes (e.g., permissions, size, hash) changed, but it does not help determine whether the changes are legitimate or malicious — it still compares against the same outdated database. Option B is wrong because updating the AIDE database with 'aide --update' would overwrite the old baseline with current file states, effectively accepting all changes as valid and destroying forensic evidence of potential compromise. Option D is wrong because restoring files from backup should only be done after confirming the changes are unauthorized; prematurely restoring could reintroduce vulnerabilities or overwrite evidence needed for investigation.

Why this answer

How to eliminate wrong answers

Option A is wrong because containerd is a container runtime that operates as a daemon (typically managed by systemd) and is designed to be used as a building block for higher-level tools, not as a standalone daemonless runtime. Option B is wrong because LXC (Linux Containers) is a system-level virtualization tool that creates full system containers with an init daemon, not a lightweight application container runtime, and it relies on a daemon (lxcfs or lxc-monitord) for management. Option C is wrong because Docker uses a client-server architecture with a persistent daemon (dockerd) that runs in the background, which contradicts the requirement for no daemon and adds overhead.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `pam_unix -t` is not a valid command; `pam_unix` is a PAM module, not a command-line tool for syntax checking. Option C is wrong because `pam_tally2 --check` is used to display login failure counts, not to verify PAM configuration syntax. Option D is wrong because `pam_faillock --test` is used to test faillock configuration for account locking, not to validate general PAM syntax.

Why this answer

How to eliminate wrong answers

Option A is wrong because manually mounting with 'mount /dev/sda3 /home' would work temporarily but does not fix the underlying fstab misconfiguration, so the error would persist on reboot. Option B is wrong because 'fsck' checks and repairs filesystem integrity, but the error here is a missing or mismatched device identifier, not a corrupt filesystem. Option C is wrong because 'mkfs.ext4' creates a new filesystem, which would destroy existing data and is unnecessary if the filesystem is already intact; the problem is purely a UUID mismatch in fstab.

Why this answer

How to eliminate wrong answers

Option A (HOME) is incorrect because HOME specifies the user's home directory, not the search path for executables. Option B (SHELL) is incorrect because SHELL indicates the default shell program (e.g., /bin/bash), not the directory search order. Option C (LD_LIBRARY_PATH) is incorrect because it controls the search path for shared libraries at runtime, not for executable commands.

Why this answer

How to eliminate wrong answers

Option A is wrong because a missing home directory would cause other issues (e.g., cron job output not being mailed, or environment variable failures), but it does not directly prevent command resolution; cron jobs can run without a home directory. Option B is wrong because if the cron daemon were not running, the job would not execute at all, not fail with a 'command not found' error. Option C is wrong because syntax errors would cause the script to fail regardless of whether it is run manually or by cron, and the script works when run manually, ruling out syntax issues.

Why this answer

How to eliminate wrong answers

Option A is wrong because `mii-tool` is a legacy utility for MII-capable interfaces and does not support modern Ethernet hardware (e.g., 1GbE or higher), often failing or returning inaccurate results on contemporary NICs. Option B is wrong because `dmesg | grep eth0` shows kernel ring buffer messages, which may include driver initialization logs but does not provide real-time, dynamic link speed or duplex information. Option C is wrong because `ip link show eth0` displays administrative and operational state (UP/DOWN) and basic flags, but it does not report negotiated speed or duplex settings; it lacks the detailed PHY-level information that `ethtool` provides.

Why this answer

How to eliminate wrong answers

Option A is wrong because `journalctl --vacuum-size=100M` only affects the systemd journal logs, not compressed old log files in `/var/log`; it reduces journal size but does not remove `.gz` files. Option C is wrong because `rm -rf /var/log/*.gz` uses a glob pattern that may fail if the file list is too long (argument list overflow) and does not handle subdirectories recursively, unlike `find`. Option D is wrong because `logrotate -f` forces a log rotation cycle, which compresses or archives current logs but does not remove already compressed old log files; it may even create new compressed files, worsening the space issue.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'kernel.pid_max' sets the maximum PID number, not a per-user process limit; it controls the total number of possible PIDs system-wide, not user-specific restrictions. Option B is wrong because 'DefaultLimitNPROC' in /etc/systemd/system.conf applies only to systemd-managed services, not to user login sessions or interactive shells, so it would not prevent a user-launched fork bomb. Option D is wrong because adding 'ulimit -u 100' to /etc/profile only affects interactive login shells and can be overridden by the user; it is not a persistent, system-wide enforcement mechanism.

Why this answer