979 questions total · 14pages · All types, answers revealed
An administrator wants to monitor real-time system resource usage to identify performance bottlenecks. Which two commands are suitable? (Choose two.)
top shows real-time processes and resource usage.
Why this answer
top and htop provide real-time process and resource monitoring.
After using 'apt-get install' to install several packages, the administrator notices that disk space is low. Which command cleans up the package cache?
Clean deletes the downloaded .deb files in the cache, freeing space.
Why this answer
The 'apt-get clean' command removes all package files (.deb) from the local cache located in /var/cache/apt/archives/. This frees up disk space without affecting installed packages, as the cache is only used for future installations or reinstallations. It is the correct command to clean up the package cache after installations.
Exam trap
A common mistake on the Linux+ exam is confusing 'autoremove' (which removes orphaned dependencies) with 'clean' (which clears the download cache).
How to eliminate wrong answers
Option B (apt-get purge) is wrong because it removes a package along with its configuration files, not the package cache. Option C (apt-get autoremove) is wrong because it removes packages that were automatically installed as dependencies and are no longer needed, but it does not clean the package cache. Option D (apt-get remove) is wrong because it removes a package but leaves its configuration files and does not touch the cached .deb files.
A technician needs to generate a self-signed certificate for an internal web server. Which OpenSSL command creates a new private key and a certificate signing request (CSR) in one step?
One-step creation of key and CSR.
Why this answer
openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr creates both key and CSR.
After configuring AppArmor, an administrator wants to verify the status of all profiles and switch a profile from complain to enforce mode. Which TWO commands are appropriate? (Choose two.)
Shows status of all AppArmor profiles.
Why this answer
B is correct because `aa-status` displays the current status of all AppArmor profiles, allowing the administrator to verify which are in enforce or complain mode. E is correct because `aa-enforce` switches a profile to enforce mode, which is the required action. A is incorrect; restarting the AppArmor service does not verify status or switch a profile's mode.
C is incorrect; `apparmor_parser -r` reloads profile definitions from disk, but does not change the mode of a profile; mode is changed via `aa-enforce` or `aa-complain`. D is incorrect because `aa-complain` sets the profile to complain mode, which is the opposite of the desired enforce mode.
Exam trap
The trap here is that candidates confuse `aa-complain` with `aa-enforce` or think that reloading a profile with `apparmor_parser` changes its mode, when in fact the mode is set separately via the `aa-*` utilities.
In a Bash script, what is the purpose of the shebang '#!/bin/bash'?
The shebang line indicates the interpreter.
Why this answer
The shebang tells the system which interpreter to use to execute the script.
A user wants to create a hard link named 'linkfile' to an existing file 'original'. Which command accomplishes this?
Correct: ln creates a hard link.
Why this answer
The ln command without -s creates a hard link. ln -s creates a symbolic link. cp copies the file; mv moves it.
Match each SELinux context component to its description.
Drag a concept onto its matching description — or click a concept then click the description.
SELinux user identity
Part of RBAC, defines allowed roles
Main attribute for type enforcement
Sensitivity level for MLS/MCS
Optional categories for MCS
Why these pairings
SELinux contexts are structured as user:role:type:level. The user identifies the SELinux user, role defines accessible types, type controls access, and level specifies sensitivity. Common confusions involve swapping user and type definitions.
A security audit reveals that users can change their password without meeting complexity requirements. Which PAM module should be configured to enforce password complexity?
pam_pwquality enforces password strength rules.
Why this answer
pam_pwquality is the module that enforces password quality rules like length, character classes, etc.
A security analyst wants to ensure that users cannot change their password more than once every 7 days. Which command and option should be used to enforce this policy for user 'jsmith'?
-m sets minimum days between password changes.
Why this answer
The `chage -m 7 jsmith` command sets the minimum number of days required between password changes for user jsmith to 7 days. The `-m` option of `chage` specifically controls the minimum password age, preventing the user from changing their password more than once every 7 days.
Exam trap
The trap here is confusing the `-m` (minimum days) and `-M` (maximum days) options of `chage`, as candidates often mix up which option controls the minimum interval between password changes versus the password expiration period.
How to eliminate wrong answers
Option A is wrong because `usermod -e` sets an account expiration date, not a minimum password age. Option C is wrong because `chage -M` sets the maximum password age (how long a password is valid), not the minimum interval between changes. Option D is wrong because `passwd -n` is not a valid option; the correct command to set minimum password age is `chage -m`, not `passwd`.
A system administrator notices that a critical application's process is consuming too much CPU, affecting other services. The administrator needs to reduce the CPU priority of that process without affecting its memory or other resources. The process PID is 4521. Which command should the administrator use?
Correct syntax for changing priority of a running process.
Why this answer
The `renice` command is used to change the priority of an already running process. By specifying `-n 10` and `-p 4521`, the administrator sets the nice value to 10, which lowers the CPU priority (higher nice value = lower priority) without affecting the process's memory or other resources. This directly addresses the need to reduce CPU consumption for the critical application.
Exam trap
The trap here is that candidates confuse `nice` (for starting processes) with `renice` (for adjusting running processes), or they misremember the correct argument order for `renice`, leading them to choose option B or C.
How to eliminate wrong answers
Option B is wrong because `nice` is used to start a new process with a specified priority, not to change the priority of an existing process; it does not accept a `-p` flag for PID. Option C is wrong because the syntax is incorrect: `renice` requires the priority value to come before the PID (e.g., `renice -n 10 -p 4521`), and placing the PID before the priority value will cause a syntax error or unintended behavior. Option D is wrong because `chrt` manipulates real-time scheduling attributes (policy and priority), not the nice value; using `-p 10` sets a real-time priority of 10, which could increase CPU priority rather than reduce it, and it does not adjust the nice value.
A Linux system fails to boot after a disk replacement. The administrator examines /etc/fstab and sees the above. What is the most likely result of this configuration?
Root mount failure causes emergency mode.
Why this answer
The /etc/fstab entry contains an incorrect UUID for the root filesystem. During boot, systemd reads fstab and attempts to mount the root partition using the specified UUID. When the UUID does not match any available block device, the mount fails, and because the root filesystem is critical, the system drops into an emergency shell to allow manual intervention.
Exam trap
The trap here is that candidates assume the system will fall back to the device name or skip the entry, but Linux strictly requires the exact UUID for mounting and will drop to an emergency shell on failure.
How to eliminate wrong answers
Option B is wrong because the system does not fall back to using the device name; if the UUID is wrong, the mount fails regardless of whether a device name is also present. Option C is wrong because fstab entries are processed sequentially, but a failed mount for a critical filesystem (like /) halts the boot process; the system does not skip to the next entry. Option D is wrong because the system does not prompt for manual fsck; fsck is triggered only if a filesystem check is required, not for a missing or incorrect UUID.
A system administrator wants to schedule a script to run every Monday at 3 AM. Which cron entry is correct?
This executes at 3:00 AM every Monday.
Why this answer
The cron syntax for 'at 3 AM every Monday' is minute 0, hour 3, day-of-month *, month *, and day-of-week 1 (where 0 and 7 both represent Sunday, and 1 represents Monday). This matches the required schedule exactly.
Exam trap
The trap here is confusing the day-of-week numbering (where Monday is 1) with the day-of-month field, and mixing up the minute and hour positions, leading candidates to select options that run on the wrong day or at the wrong time.
How to eliminate wrong answers
Option A is wrong because '0 3 1 * *' means 'at 3:00 AM on the 1st day of every month', not every Monday. Option B is wrong because '3 0 * * 1' means 'at 12:03 AM (0:03) every Monday', not 3:00 AM. Option C is wrong because '0 3 * * 2' means 'at 3:00 AM every Tuesday' (day-of-week 2), not Monday.
A Linux administrator needs to run a Docker container in detached mode with port mapping from host port 8080 to container port 80, and mount a host directory /data to /app/data inside the container. Which command achieves this?
This command correctly uses -d for detached, -p for port mapping, and -v for volume mount.
Why this answer
docker run -d -p 8080:80 -v /data:/app/data --name webapp nginx runs the container detached, maps ports, and mounts a bind volume.
Refer to the exhibit. A user reports that they cannot write to /data, receiving a 'No space left on device' error. However, the df output shows 5.2G available. What is the most likely cause?
Running out of inodes would prevent file creation even if space is available. Check with df -i.
Why this answer
The 'No space left on device' error despite 5.2G available space indicates the filesystem has run out of inodes. Inodes store metadata about files, and when exhausted, no new files can be created even if free space exists. This is common in filesystems with many small files.
Option C is correct. Option A is incorrect because fstab is configured correctly; the filesystem is mounted. Option B is incorrect because the mount options do not include 'ro' (read-only).
Option D is incorrect because the UUID has not changed; the partition is accessible.
Which TWO of the following are common causes of a system failing to boot? (Select two.)
Causes failure to boot.
Why this answer
A corrupted kernel image prevents the bootloader from loading the kernel into memory, causing the boot process to fail at the stage where the kernel is executed. Without a valid kernel, the system cannot initialize hardware or start the init process, resulting in a kernel panic or a hang.
Exam trap
CompTIA often tests the distinction between boot-time failures (kernel/GRUB issues) and post-boot configuration errors (time zone, IP address), so the trap here is that candidates mistakenly think a full hard drive or incorrect IP address can prevent booting, when in reality those only affect functionality after the OS is running.
A system administrator needs to create a new user account with a home directory and the bash shell. Which command should be used?
Correct: -m creates home directory, -s sets shell to /bin/bash.
Why this answer
The `-m` flag tells `useradd` to create the user's home directory if it does not already exist, and `-s /bin/bash` sets the login shell to bash. This meets the requirement of creating a new user with a home directory and the bash shell.
Exam trap
The trap here is that candidates often confuse the `-d` flag (which only sets the home directory path in `/etc/passwd`) with the `-m` flag (which actually creates the directory), leading them to choose option C instead of D.
How to eliminate wrong answers
Option A is wrong because the `-r` flag creates a system account (typically with a UID below 1000 and no home directory by default), which is not appropriate for a regular user needing a home directory. Option B is wrong because the `-c` flag is used to add a comment (e.g., full name) to the user account, not to create a home directory; it also lacks the `-m` flag. Option C is wrong because while `-d /home/user` specifies the home directory path, it does not actually create the directory; the `-m` flag is required to create it, and without it the home directory will not exist.
A technician needs to trace the system calls made by a running process to debug a performance issue. Which tool should be used?
strace traces system calls.
Why this answer
`strace -p PID` intercepts and records system calls (kernel-level operations like file I/O, network, and process control) made by a running process, which is exactly what is needed to trace system calls for debugging performance issues. The `-p` flag attaches strace to an existing process by its PID, allowing real-time monitoring of kernel interactions.
Exam trap
The trap here is that candidates confuse `ltrace` (library calls) with `strace` (system calls), as both trace function calls but at different layers of the operating system stack.
How to eliminate wrong answers
Option A is wrong because `gdb -p PID` is a debugger for inspecting and modifying program state at the source-code or assembly level, not for tracing system calls; it focuses on user-space debugging, not kernel call tracing. Option B is wrong because `lsof -p PID` lists open file descriptors (files, sockets, pipes) for a process, but it does not trace system calls or their timing; it provides a static snapshot of open handles, not dynamic call tracing. Option C is wrong because `ltrace -p PID` traces library calls (user-space function calls to shared libraries like glibc), not system calls; it intercepts calls to dynamically linked library functions, whereas the question specifically asks for system calls.
During a security audit, a Linux administrator finds that an unauthorized service is listening on TCP port 4444. The service is not managed by systemd. Which of the following commands should the administrator use to identify the process and disable it?
ss -tlnp shows listening sockets with PIDs; kill can then stop the process.
Why this answer
'ss -tlnp' lists TCP listening sockets with numeric addresses and the associated process PID. Piping the output through 'grep :4444' isolates the unauthorized service, and the PID can then be used with 'kill' to terminate the process. Since the service is not managed by systemd, systemctl commands are irrelevant, making 'kill' the appropriate method to stop the process.
Exam trap
The trap here is that candidates assume all services are managed by systemd and reach for 'systemctl stop' or 'systemctl disable', but the question explicitly states the service is not managed by systemd, so only process-level commands like 'kill' are valid.
How to eliminate wrong answers
Option B is wrong because 'fuser 4444/tcp' requires the port to be specified in a different syntax (e.g., 'fuser 4444/tcp' is invalid; the correct syntax is 'fuser 4444/tcp' but it returns a PID, not a service name, and then using 'systemctl stop' is incorrect because the service is not managed by systemd. Option C is wrong because while 'lsof -i :4444' can find the PID, 'systemctl disable' is used to prevent a systemd service from starting at boot, not to stop a running process, and it cannot disable a non-systemd service. Option D is wrong because 'systemctl status' requires a known service name and only works with systemd-managed services; the unauthorized service is not managed by systemd, so this command cannot identify it.
A system administrator needs to ensure that the Apache HTTP server starts automatically at boot and is started immediately without rebooting. Which command accomplishes both tasks?
Performs both enable and start in one command.
Why this answer
The `systemctl enable --now httpd` command combines two actions: it creates the necessary symlinks to start the Apache HTTP server automatically at boot (enable) and immediately starts the service without rebooting (start). The `--now` flag is the key to performing both tasks in a single command, fulfilling the requirement exactly.
Exam trap
The trap here is that candidates often think `systemctl enable` alone starts the service, or they confuse `--now` with a reboot requirement, leading them to pick option B or C instead of the combined D.
How to eliminate wrong answers
Option A is wrong because `systemctl disable --now httpd` stops the service and removes the boot-time symlinks, which is the opposite of what is needed. Option B is wrong because `systemctl enable httpd` only configures the service to start at boot but does not start it immediately; a separate `systemctl start` would be required. Option C is wrong because `systemctl start httpd` starts the service immediately but does not enable it for automatic startup at boot, so it would not survive a reboot.
A technician notices that a user can execute a binary with elevated privileges even though the user is not in the sudoers file. The binary has the SUID bit set. Which command would remove the SUID bit from the binary?
chmod u-s removes the SUID bit, but the exam expects the more comprehensive chmod 0755 that resets all special bits. Therefore, option A is not the correct answer.
Why this answer
`chmod u-s /path/to/binary` is the direct command to remove the SUID bit from the file. It unsets the setuid permission for the owner, which immediately prevents the binary from running with the owner's privileges. While `chmod 0755 /path/to/binary` also removes the SUID bit, it additionally resets all permission bits to a specific numeric mode (755), which may not be desired or necessary.
The question asks only for removing the SUID bit, so `chmod u-s` is the most precise and correct answer.
Exam trap
Candidates might think that using a numeric mode like 0755 is required because it 'resets permissions safely,' but the question specifically asks only to remove the SUID bit. Using `chmod u-s` accomplishes exactly that without altering other permissions. The exam expects the direct method, not an overhanded numeric reset.
How to eliminate wrong answers
Option A is wrong because `chmod u-s` correctly removes the SUID bit from the user (owner) — this is actually a valid command to remove the SUID bit, but the question asks for the command that would remove it, and while this works, the exam expects the numeric mode (0755) as the 'correct' answer because it is more explicit and also removes any other special bits like SGID or sticky bit. Option B is wrong because `chmod g-s` removes the SGID (setgid) bit, not the SUID bit; the SGID bit affects group privileges, not user-level elevation. Option C is wrong because `chmod o-s` attempts to remove the 'sticky bit' or other special bits for 'others', but the 's' permission for 'others' is not a standard Linux permission; this command would have no effect on the SUID bit and may produce an error or be ignored.
An administrator needs to replace all occurrences of 'oldhost' with 'newhost' in the file /etc/hosts. Which sed command should be used?
This replaces all occurrences in-place.
Why this answer
sed -i 's/oldhost/newhost/g' /etc/hosts performs an in-place substitution globally.
A technician wants to find all files owned by user 'jane' in the /home directory. Which command accomplishes this?
Correct: find with -user jane.
Why this answer
The find command with -user option searches for files owned by a specific user.
A system administrator is troubleshooting a network issue where a server cannot reach the internet. The server's IP address is 192.168.1.10/24, and the default gateway is 192.168.1.1. Which command should be used to verify the default gateway configuration?
Shows the routing table, including default route.
Why this answer
The `ip route show` command displays the kernel's IPv4 routing table, which includes the default gateway entry (destination 0.0.0.0/0 via 192.168.1.1). This directly verifies whether the default gateway is configured correctly for the server to reach external networks.
Exam trap
The trap here is that candidates often confuse `ip addr show` (which shows IP addresses) with `ip route show` (which shows routing table), leading them to select the wrong command when asked to verify the default gateway.
How to eliminate wrong answers
Option A is wrong because `ip neigh show` displays the ARP cache (neighbor table), showing MAC-to-IP mappings for directly connected hosts, not the default gateway configuration. Option B is wrong because `ip addr show` displays IP addresses and interface properties, not routing information such as the default gateway. Option D is wrong because `ip link show` shows link-layer (Layer 2) interface status and MTU, not Layer 3 routing entries.
In a Bash script, what is the correct way to check if a file named '/etc/passwd' exists and is a regular file?
-f checks if the file exists and is a regular file.
Why this answer
The -f file test operator returns true if the file exists and is a regular file.
Which command would a Linux administrator use to locate all files in the /var/log directory that have been modified within the last 7 days?
Correct. find -mtime -7 finds files modified within the last 7 days.
Why this answer
The find command with -mtime -7 finds files modified less than 7 days ago. The other options are either incorrect or not suitable for this task.
After editing the network configuration file /etc/sysconfig/network-scripts/ifcfg-ens33 on a CentOS system, the network service fails to restart with an error message. Which command should be used to display detailed error messages from the network service?
Shows service status and recent log entries.
Why this answer
The `systemctl status network` command is the correct tool to display detailed error messages from the network service because it shows the current status, recent log entries, and any failure messages from the systemd unit managing the network service. On CentOS, network services are controlled by systemd, and `systemctl status` directly queries the unit's state and journal for errors, making it the most straightforward diagnostic command after a restart failure.
Exam trap
The trap here is that candidates often choose `journalctl -u network` (Option C) because they know it shows logs, but they overlook that `systemctl status network` is the more direct and concise command for viewing the immediate failure reason and service state, as specified in the XK0-005 objectives for troubleshooting systemd services.
How to eliminate wrong answers
Option A is wrong because `ip link` only displays and manages network interface link-layer states (e.g., up/down, MAC addresses) and does not retrieve service-level error messages or logs from the network service. Option C is wrong because `journalctl -u network` displays the full journal log for the network unit, which can show errors, but it is not the primary command to display detailed error messages immediately after a restart failure; `systemctl status` provides a concise summary including the last few log lines and the exact failure reason. Option D is wrong because `ifconfig` is a deprecated command for configuring network interfaces and does not interact with systemd or the network service's error reporting at all.
An administrator wants to force a password change for user 'alice' on next login. Which command is appropriate?
This command immediately expires alice's password, forcing a change on next login. It is the standard method.
Why this answer
The correct command to force a password change on next login is `passwd --expire alice`. This immediately expires alice's password, requiring a change at next login. The other options are incorrect: `passwd -l` locks the account, `chage -l alice` lists account aging information without changing anything, and `usermod -f` sets the inactivity period.
What does the `set -x` command do when placed at the top of a bash script?
Correct. set -x enables debugging output, printing commands and their arguments as they are executed.
Why this answer
`set -x` enables a shell debugging mode that prints each command (after expansion) to stderr before executing it. This is commonly used in bash scripts to trace execution flow and debug complex logic.
Exam trap
The trap here is that candidates confuse `set -x` with `set -e` (exit on error) or `set -u` (treat unset variables as error), because all three are common debugging options but serve distinct purposes.
How to eliminate wrong answers
Option A is wrong because position parameters (like $1, $2) are enabled by default in bash scripts; `set -x` does not affect them. Option B is wrong because exiting on error is controlled by `set -e`, not `set -x`. Option C is wrong because treating unset variables as errors is controlled by `set -u`, not `set -x`.
A system administrator notices that a service fails to start at boot with the message "Failed to start MyApp.service: Unit not found". The administrator checks the service unit file at /etc/systemd/system/myapp.service. The target wanted-by is multi-user.target. The administrator runs `systemctl enable myapp.service` successfully, but the service still does not start at boot. What is the most likely cause?
After adding a new unit file, daemon-reload is required. Even though enable succeeded, systemd's in-memory state might be stale.
Why this answer
When `systemctl enable myapp.service` is run, systemd creates the necessary symlinks in the `.wants` directory but does not automatically reload its configuration. The service fails to start at boot because systemd still holds the old configuration in memory and does not recognize the newly enabled unit. Running `systemctl daemon-reload` forces systemd to re-read all unit files and apply the new enablement, allowing the service to start at boot.
Exam trap
The trap here is that candidates assume `systemctl enable` alone is sufficient to make a service start at boot, overlooking that systemd must reload its configuration to recognize the newly enabled unit.
How to eliminate wrong answers
Option B is wrong because a syntax error in the unit file would cause `systemctl enable` to fail or produce an error message, not succeed silently; the administrator ran enable successfully, so syntax is not the issue. Option C is wrong because a missing dependency would produce a different error during boot (e.g., dependency failed) rather than 'Unit not found', and `systemctl enable` would still succeed. Option D is wrong because `systemctl enable` automatically creates the correct symlink into the `/etc/systemd/system/multi-user.target.wants/` directory; if the symlink were missing, the enable command would have failed or not completed.
An administrator runs auditctl -l and ausearch -k auth_log -ts today as shown in the exhibit. The administrator expects to see audit events for /var/log/auth.log but gets no matches. Which TWO actions should the administrator take to resolve this issue?
If auditd is not running, no events are captured.
Why this answer
The audit daemon (auditd) must be running to process audit rules and generate events. If auditd is not active, rules loaded via auditctl will have no effect, and commands like ausearch will return no results. The administrator should verify the service status with 'systemctl status auditd' and start it if necessary.
Exam trap
CompTIA often tests the misconception that loading rules with auditctl is sufficient to generate audit events, without verifying that the auditd service is actually running to process and log those events.
You are a Linux system administrator for a small company. You have written a BASH script that checks disk usage and sends an email alert if any partition exceeds 90% usage. The script works when run manually but does not produce alerts when run via cron. Which of the following is the most likely cause?
The mail command is often in /usr/sbin, which may not be in cron's default PATH; the script fails to execute mail silently.
Why this answer
When a script runs manually, it inherits the user's interactive shell environment, including the PATH variable that typically includes directories like /usr/bin and /usr/local/bin where the mail command resides. However, cron jobs execute in a minimal environment with a very restricted PATH (often just /usr/bin:/bin). If the mail command is located in a directory not in cron's default PATH, such as /usr/sbin or /opt/bin, the script will fail silently when attempting to send the email, even though the disk usage check itself succeeds.
This is the most common cause of scripts working manually but failing under cron.
Exam trap
CompTIA often tests the concept that cron jobs have a restricted environment, particularly PATH, and candidates mistakenly focus on script permissions or relative paths instead of the missing command path in cron's minimal shell.
How to eliminate wrong answers
Option B is wrong because incorrect file permissions would prevent the script from executing at all, whether run manually or via cron, and the question states the script works when run manually. Option C is wrong because if the cron scheduler were disabled, no cron jobs would run at all, but the question implies the script is scheduled and runs (it just doesn't produce alerts). Option D is wrong because using relative paths to check partitions would cause the script to fail regardless of whether it runs manually or via cron, unless the working directory is explicitly set; the script works manually, so relative paths are not the issue.
The system is a web server running Apache and MySQL. Based on the exhibit, which of the following is the most likely cause of the full disk?
Correct: Web server logs commonly fill root partitions.
Why this answer
Apache access and error logs are a common cause of full disks on web servers because they can grow unchecked, consuming all available space. By default, Apache logs are stored in /var/log/httpd/ or /var/log/apache2/ and are not rotated unless logrotate is configured. The exhibit likely shows a high percentage of disk usage in /var/log, confirming that log files are the culprit.
Exam trap
CompTIA often tests the candidate's ability to distinguish between common disk-filling causes (logs, databases, user files) by presenting a scenario where the exhibit shows a specific directory (like /var/log) as full, leading candidates to overlook the log rotation misconfiguration and instead blame MySQL or user home directories.
How to eliminate wrong answers
Option A is wrong because a user's home directory filling up would typically affect /home, not the system partition where Apache logs reside, and the exhibit likely shows /var/log as the full partition. Option C is wrong because /tmp is usually on a separate filesystem or cleaned on reboot, and its growth would not typically cause a full disk on a production web server without other symptoms. Option D is wrong because MySQL database growth would be reflected in /var/lib/mysql, not in /var/log, and the exhibit points to log files as the issue.
An administrator needs to restrict SSH access to the server so that only a specific IP range (192.168.1.0/24) can connect, and password authentication is disabled. Which THREE steps must be taken?
Firewall restricts source IP at network layer.
Why this answer
It uses iptables to create a firewall rule that accepts SSH traffic (TCP port 22) only from the 192.168.1.0/24 subnet, followed by a catch-all rule that drops all other SSH traffic. This enforces network-level access control. Option D is correct because 'AllowUsers *@192.168.1.*' in sshd_config restricts SSH logins to users connecting from IP addresses matching that pattern, providing application-level filtering.
Option E is correct because 'PasswordAuthentication no' disables password-based authentication, forcing the use of key-based or other non-password methods.
Exam trap
The trap here is that candidates may think 'UsePAM yes' or 'PermitRootLogin without-password' are necessary for IP restriction or disabling passwords, when in fact they address unrelated authentication mechanisms and are not among the three required steps.
A CentOS 7 web server experienced an abrupt power loss. Upon reboot, the httpd service fails to start. The administrator runs `systemctl status httpd` and sees 'Active: failed (Result: exit-code)'. The journal displays 'Permission denied: "/var/www/html/index.html"'. The file `/var/www/html/index.html` has permissions `-rw-r--r--` and is owned by `apache:apache`. SELinux is in enforcing mode. Which action should the administrator take to resolve the issue?
Restores default SELinux labels, which may have been corrupted during power loss.
Why this answer
The httpd service fails because SELinux is in enforcing mode and the file /var/www/html/index.html has an incorrect SELinux context, likely httpd_sys_content_t. The restorecon -R /var/www/html command restores the default SELinux security contexts for the directory and its contents, allowing Apache to read the file. This is the standard fix when SELinux contexts are lost or corrupted, such as after a power loss or file restoration.
Exam trap
The trap here is that candidates may confuse file permissions (rw-r--r--) with SELinux contexts, or assume ownership changes are needed, when the real issue is a missing or incorrect SELinux label that restorecon fixes.
How to eliminate wrong answers
Option A is wrong because disabling SELinux with setenforce 0 temporarily bypasses security but is not a proper fix; it weakens system security and does not address the underlying context issue. Option B is wrong because changing ownership to root:root would prevent the Apache user (apache) from accessing the file, worsening the problem. Option D is wrong because the httpd_can_network_connect boolean controls network connections from httpd, not file access permissions; it is irrelevant to the 'Permission denied' error on a local file.
A Linux administrator needs to verify which network interfaces are up and their IP addresses on a server. Which command provides this information?
Correct. ip addr shows detailed interface information including IP addresses and status.
Why this answer
The `ip addr` command displays all network interfaces along with their IP addresses, MAC addresses, and status (UP/DOWN).
The script in the exhibit runs successfully but the administrator expects it to indicate success. What change should be made?
Zero exit code indicates success.
Why this answer
The script uses 'exit 1' to terminate, which indicates a failure or error condition to the shell. The administrator expects the script to indicate success, so the exit code must be changed to 'exit 0', which is the standard Unix/Linux convention for successful execution. Exit codes are how scripts communicate their status to the calling process, and only exit 0 means success.
Exam trap
CompTIA often tests the fundamental distinction between exit codes 0 and 1, where candidates may mistakenly think that 'exit 1' is correct for a successful script or that variable naming or quoting affects the exit status.
How to eliminate wrong answers
Option A is wrong because removing the dollar sign from $system_info would treat it as a literal string instead of a variable reference, breaking the script's ability to use the stored value. Option C is wrong because changing the variable name to SYSTEM_INFO would not affect the exit code; variable names are case-sensitive but do not influence the script's success or failure status. Option D is wrong because while changing 'exit 1' to 'exit 0' is correct, removing the quotes around $system_info is unnecessary and could cause word splitting or globbing issues if the variable contains spaces or special characters, potentially breaking the script.
An administrator needs to run a container using a specific user ID to match host file permissions. Which Docker option should be used when running the container?
Sets user ID inside container.
Why this answer
The `-u` (or `--user`) option in Docker allows you to run the container process with a specific user ID (UID) instead of the default root (UID 0). By specifying `-u 1001`, the container's main process will run as UID 1001, which can be matched to a host user's UID to ensure proper file ownership and permissions when accessing mounted volumes. This is essential for avoiding permission denied errors when the container writes files to a bind-mounted host directory.
Exam trap
The trap here is that candidates often confuse environment variables (like `-e USER=1001`) with the actual user ID change, mistakenly thinking setting an environment variable named `USER` will alter the process's effective UID, when in reality only `-u` or the `USER` directive in a Dockerfile changes the runtime user.
How to eliminate wrong answers
Option B is wrong because `-e USER=1001` sets an environment variable named `USER` inside the container, which does not change the effective user ID of the container process; the process still runs as root unless another mechanism (like `USER` in the Dockerfile) is used. Option C is wrong because `-v /host:/container` is a volume mount that maps a host directory into the container, but it does not control the user ID under which the container runs; file permissions are still determined by the container's UID. Option D is wrong because `--name mycontainer` simply assigns a custom name to the container for identification and management purposes, and has no effect on the user ID or file permissions.
A Linux administrator needs to check the listening TCP ports on a server. Which command should be used to view only listening TCP ports and the associated processes?
Correctly shows listening TCP ports with process info.
Why this answer
The `ss -tlnp` command displays only TCP sockets (`-t`), listening sockets (`-l`), numeric addresses/ports (`-n`), and the associated process information (`-p`). This is the modern replacement for `netstat` and is the most direct way to view listening TCP ports and their processes on a Linux system.
Exam trap
The trap here is that candidates often choose `netstat -tlnp` (option C) because it is a familiar legacy command, but the exam expects knowledge of the modern `ss` utility, which is the recommended tool on current Linux distributions and is more likely to be available by default.
How to eliminate wrong answers
Option A is wrong because `lsof -iTCP -sTCP:LISTEN` does show listening TCP ports and processes, but it is not the most standard or efficient command for this task; it is a file-descriptor-based tool that can be slower and less commonly used for this specific purpose in Linux administration. Option B is wrong because `nmap -sT localhost` performs a TCP connect scan against the local host, which is a network scanning tool that can disrupt services and is not designed to simply list listening ports with their associated processes; it also requires root privileges for certain scans and does not show process IDs. Option C is wrong because `netstat -tlnp` does show listening TCP ports and processes, but `netstat` is deprecated on many modern Linux distributions (e.g., RHEL 7+, Ubuntu 16.04+) in favor of `ss`, and may not be installed by default.
A Linux administrator wants to monitor changes to the /etc/passwd file for security auditing. Which auditctl command should be used?
Correctly watches for write and attribute changes.
Why this answer
auditctl -w /etc/passwd -p wa -k passwd_change watches for write and attribute changes.
An administrator needs to set up a new LVM volume. Which two commands are necessary in the initial setup before creating a logical volume?
vgcreate creates a volume group from one or more physical volumes.
Why this answer
Before creating a logical volume (LV), you must first prepare the physical storage devices and then group them into a volume group. The `pvcreate` command initializes a block device (e.g., /dev/sdb) as a physical volume (PV) by writing LVM metadata to it. The `vgcreate` command then creates a volume group (VG) from one or more PVs, which serves as the pool of storage from which logical volumes are carved.
Without these two steps, the LVM subsystem has no recognized storage to allocate.
Exam trap
The trap here is that candidates often confuse the order of LVM commands, thinking `lvcreate` is the first step, but LVM requires a strict hierarchy: PV → VG → LV, and `pvcreate` and `vgcreate` must precede any logical volume creation.
A Linux administrator needs to implement password complexity rules requiring at least one uppercase letter, one digit, and a minimum length of 10 characters. Which two PAM configuration entries would be used? (Choose TWO.)
Correct: pam_pwquality with minlen,ucredit,dcredit enforces required complexity.
Why this answer
The `pam_pwquality.so` module enforces password complexity rules. The `minlen=10` parameter sets the minimum password length to 10 characters, `ucredit=1` requires at least one uppercase letter, and `dcredit=1` requires at least one digit. The `requisite` control ensures that if these checks fail, authentication is immediately denied.
Option E is also correct because `enforce_for_root` applies the same complexity rules to the root user, which is often needed to fully enforce the policy. Options A, B, and D are incorrect: `pam_pwhistory.so` is for password history, not complexity; `pam_unix.so` does not enforce complexity; `pam_faillock.so` is an `auth` module for account lockout, not password strength.
Exam trap
The CompTIA Linux+ exam often tests the distinction between `pam_pwquality.so` (complexity) and `pam_pwhistory.so` (history), and candidates may confuse `auth` modules (like `pam_faillock.so`) with `password` modules, or forget that `pam_unix.so` does not enforce complexity rules.
To limit the number of processes a user can create, which file should be configured?
This file defines hard and soft limits for resources like nproc.
Why this answer
/etc/security/limits.conf sets resource limits per user/group, including nproc (number of processes).
A web server on RHEL 8 is serving content from a non-default directory /data/web. The SELinux context is set to default_t for the directory, causing access denials. Which command should be used to set the correct context for web content?
Adds default context to policy, ensuring persistence after restorecon.
Why this answer
`semanage fcontext` modifies the SELinux file context policy persistently, and the regular expression `/data/web(/.*)?` ensures that the directory and all its contents are labeled with `httpd_sys_content_t`, which is the type required for web content served by Apache. This persistent change survives file system relabeling, unlike `chcon` which only sets a temporary context.
Exam trap
The Linux+ exam often tests the distinction between temporary (`chcon`) and persistent (`semanage fcontext`) context changes, and candidates mistakenly choose `chcon` because it works immediately but fails after a relabel or restorecon.
How to eliminate wrong answers
Option A is wrong because `setsebool -P httpd_can_network_connect on` enables a boolean that allows httpd to make network connections, but it does not change the file context of `/data/web` to resolve access denials. Option B is wrong because `restorecon -R /data/web` restores the default SELinux context based on the policy, but since the directory is non-default and has no matching fcontext rule, it would reset to `default_t` or `unconfined_t`, not to `httpd_sys_content_t`. Option C is wrong because `chcon -t httpd_sys_content_t /data/web` sets the context only on the directory itself (not recursively) and the change is ephemeral—it will be lost after a file system relabel or `restorecon` run.
Refer to the exhibit. A system administrator notices that /var/log is nearly full. Which configuration change would resolve the issue and prevent recurrence?
Smaller size triggers rotation sooner, keeping log files smaller and freeing space.
A Linux administrator is tasked with adding a new 1TB hard drive to a server. The drive has been partitioned and formatted with ext4, resulting in the device /dev/sdb1. The administrator needs the drive to be mounted persistently at /data. After adding an entry to /etc/fstab, the administrator runs 'mount -a' and sees the error: 'mount: /data: mount point does not exist.' Which of the following should the administrator do first to resolve the issue?
The mount point must exist before mounting; mkdir creates it.
Why this answer
The error 'mount point does not exist' indicates that the directory /data has not been created on the filesystem. The mount command requires an existing directory to attach the device to. Creating the /data directory with mkdir resolves this, allowing mount -a to succeed.
Exam trap
The trap here is that candidates may assume the mount point is automatically created by the system or that the error indicates a filesystem problem, leading them to choose fsck or reformatting instead of the simple directory creation step.
How to eliminate wrong answers
Option A is wrong because mkfs.ext4 would reformat the partition, destroying any existing filesystem and data, which is unnecessary since the drive is already formatted with ext4. Option B is wrong because rebooting will not create the missing mount point directory; it would only reattempt the same failing mount from /etc/fstab. Option D is wrong because fsck checks and repairs filesystem integrity, but the error is about a missing directory, not filesystem corruption.
Given the journalctl output for the httpd service, which of the following is the most likely cause?
Directories need execute permission to traverse.
Why this answer
The journalctl output for the httpd service likely shows 'Permission denied' errors when Apache tries to serve files from /var/www. The most common cause is that the /var/www directory lacks the execute (x) permission for the Apache user (typically 'apache' or 'www-data'). Without execute permission on the directory, Apache cannot traverse into it to access files, even if the files themselves have correct permissions.
This is a standard Linux permission issue distinct from SELinux or file-level read permissions.
Exam trap
CompTIA often tests the distinction between directory execute permissions and file read permissions, trapping candidates who assume that read permission on the file is sufficient without considering that directory traversal requires execute.
How to eliminate wrong answers
Option B is wrong because incorrect SELinux context would produce 'Permission denied' errors with an AVC denial message in the audit log, not the generic 'Permission denied' seen in journalctl for httpd. Option C is wrong because if Apache were running under the wrong user, it would likely fail to bind to privileged ports (e.g., 80/443) or show user-related errors, not directory traversal permission errors. Option D is wrong because missing read permission on index.html would cause a 'Permission denied' error specifically for that file, but the journalctl output typically shows errors for the directory itself when Apache cannot access /var/www, and the question implies a broader issue affecting all files, not just one.
An administrator wants to schedule a script to run every Monday at 3 AM. Which crontab entry is correct?
Runs at 3:00 AM every Monday.
Why this answer
The crontab syntax requires five fields: minute, hour, day of month, month, and day of week. '0 3 * * 1' means minute 0, hour 3 (3 AM), any day of month (*), any month (*), and day of week 1 (Monday). This precisely schedules the script to run at 3:00 AM every Monday.
Exam trap
CompTIA often tests the distinction between the minute field and the day-of-week field, trapping candidates who confuse the first field (minute) with the hour field, or who misinterpret the day-of-week field as the day-of-month field.
How to eliminate wrong answers
Option B is wrong because the first field is '*' instead of '0', which means the script would run every minute from 3:00 AM to 3:59 AM on Mondays, not just once at 3:00 AM. Option C is wrong because the day-of-week field is '*' (every day), so the script would run at 3:00 AM every day, not just Mondays. Option D is wrong because the third field is '1' (day of month), which schedules the script to run at 3:00 AM on the 1st day of every month, regardless of the day of week; the '1' in the day-of-week field is ignored because the day-of-month field is not '*'.
A systems administrator needs to restrict SSH access to a Linux server so that only users in the 'sshusers' group can log in. Which configuration change should be made in /etc/ssh/sshd_config?
AllowGroups restricts SSH access to members of the specified group.
Why this answer
The 'AllowGroups' directive in /etc/ssh/sshd_config restricts SSH login to only users who are members of the specified group. By adding 'AllowGroups sshusers', only users in the 'sshusers' group will be permitted to authenticate via SSH, while all others are denied. This is the standard OpenSSH mechanism for group-based access control.
Exam trap
The trap here is that candidates confuse 'AllowUsers' with 'AllowGroups', mistakenly thinking that 'AllowUsers sshusers' would restrict access to members of the 'sshusers' group, when in fact it only allows a user whose exact username is 'sshusers'.
How to eliminate wrong answers
Option A is wrong because 'AllowUsers' expects a list of individual usernames, not a group name; using 'AllowUsers sshusers' would attempt to match a user literally named 'sshusers', not a group. Option B is wrong because 'DenyGroups all' is not a valid directive; OpenSSH does not support a group named 'all', and even if it did, it would deny only that specific group, not all users. Option D is wrong because 'PermitRootLogin no' only prevents root from logging in via SSH, but does not restrict other users; adding users to 'sshusers' alone does not enforce group-based access without an 'AllowGroups' or 'DenyGroups' directive.
After a system update, a server takes significantly longer to boot. The administrator wants to identify which systemd service is causing the delay. Which command provides a detailed analysis of boot time spent by each service?
Outputs a list of services with time taken, sorted from longest to shortest.
Why this answer
The `systemd-analyze blame` command prints a list of all running systemd units, sorted by the time they took to initialize during boot. This directly answers the administrator's need to identify which specific service is causing the delay, as it shows the exact time spent by each service.
Exam trap
The trap here is that candidates confuse `systemd-analyze blame` with `systemd-analyze critical-chain`, mistakenly thinking the latter provides per-service timing, when in fact it only shows the dependency chain and not the individual time spent by each service.
How to eliminate wrong answers
Option A is wrong because `systemd-analyze time` only shows the total kernel, initrd, and userspace boot time, not a per-service breakdown. Option C is wrong because `systemd-analyze critical-chain` displays the critical boot chain (the tree of units that are critical for reaching the target), but it does not provide the detailed time spent by each service; it focuses on dependencies and bottlenecks in the chain. Option D is wrong because `systemd-analyze plot` generates an SVG graph of the boot timeline, which is useful for visual analysis but does not give a simple, sorted list of service times in the terminal.
Which command displays the current SELinux mode?
Displays current mode.
Why this answer
getenforce displays the current SELinux mode (Enforcing, Permissive, Disabled). sestatus provides more detail including mode and policy version. setenforce changes mode, getsebool shows booleans.
A system administrator needs to configure sudo so that members of the 'wheel' group can execute any command without a password. Which line should be added to /etc/sudoers (using visudo)?
Correct: % denotes group, NOPASSWD eliminates password prompt.
Why this answer
To allow wheel group to run all commands without a password, the line should be '%wheel ALL=(ALL) NOPASSWD: ALL'.
Which THREE conditions must be met for a Linux container to run with user namespaces enabled? (Choose three.)
Docker requires --userns-remap to enable user namespaces.
Why this answer
User namespaces must be explicitly enabled in the container runtime configuration (e.g., `--userns=host` or `userns-remap` in Docker/Podman) to isolate the container's UID/GID mappings from the host. Without this configuration, the container will run in the default host namespace, negating the security benefits of user namespaces.
Exam trap
CompTIA often tests the misconception that a container must have UID 0 in its image or be started with root privileges to use user namespaces, when in fact user namespaces map an unprivileged host user to UID 0 inside the container.
A developer wants to run a containerized application using Podman in a rootless environment. Which of the following is a key difference between Podman and Docker that the developer should be aware of?
Correct. Podman is daemonless and supports rootless containers.
Why this answer
Podman supports rootless containers natively without requiring a daemon, unlike Docker which traditionally requires a daemon (dockerd) running as root.
A security audit reveals that an SELinux boolean 'httpd_can_network_connect' is currently off, but a web application requires Apache to connect to a database server. Which command should the administrator use to enable this boolean persistently?
Correctly sets the boolean persistently.
Why this answer
setsebool -P makes the change persistent across reboots.
A system administrator is troubleshooting a DNS resolution issue. The command `dig example.com` returns a response, but `ping example.com` fails with 'ping: example.com: Name or service not known'. Which of the following is the most likely cause?
dig uses resolver settings in /etc/resolv.conf but may use its own; inconsistent config can cause this.
Why this answer
The `dig` command bypasses the system resolver and queries the DNS server directly, so it can resolve the name even if the resolver is misconfigured. `ping` uses the system resolver (glibc's `gethostbyname` or `getaddrinfo`), which may be configured to use different DNS servers (e.g., via NetworkManager, systemd-resolved, or a local caching resolver). This mismatch causes `ping` to fail while `dig` succeeds.
How to eliminate wrong answers
Option A is wrong because an incorrect entry in /etc/hosts would affect both `dig` (which does not consult /etc/hosts) and `ping` (which does), but the symptom is that `dig` works and `ping` fails, so /etc/hosts is not the cause. Option B is wrong because nscd is a caching daemon; if it were not running, the system resolver would still work (just without caching), so it would not cause `ping` to fail while `dig` succeeds. Option D is wrong because if no DNS server were configured in /etc/resolv.conf, `dig` would also fail (it reads /etc/resolv.conf by default unless overridden), so this does not match the symptom.
Option E is wrong because a firewall blocking ICMP would cause `ping` to time out or show 'Destination Host Unreachable', not the specific error 'Name or service not known', which is a resolution failure, not a network reachability failure.
A user reports that a web server is unreachable. The administrator runs 'curl -I https://example.com' and gets no response. Which command should be used next to check if the server is reachable at the network level?
Ping tests ICMP echo to verify network reachability.
Why this answer
The `curl -I` command failed to get a response, which could be due to a network-level issue rather than an application-layer problem. The `ping` command uses ICMP echo requests to test basic IP-level connectivity to the host, bypassing higher-layer protocols like HTTP/TLS. If the server is unreachable at the network layer, `ping` will show packet loss or timeouts, confirming a routing or firewall issue.
Exam trap
The trap here is that candidates may choose `ss` or `lsof` because they are familiar with checking local services, but these commands cannot test remote reachability, which is the core of the question.
How to eliminate wrong answers
Option B is wrong because `dig -x example.com` performs a reverse DNS lookup, which checks if an IP address resolves to a hostname, not whether the server is reachable at the network level. Option C is wrong because `lsof -i :443` lists local processes listening on TCP port 443, which only checks if a service is running locally, not if the remote server is reachable. Option D is wrong because `ss -tlnp | grep 443` shows local TCP listening sockets on port 443, which is a local diagnostic tool and cannot verify network-level reachability to a remote host.
Which command displays the current SELinux mode (e.g., enforcing, permissive, disabled)?
Correct. getenforce prints enforcing, permissive, or disabled.
Why this answer
getenforce shows the current mode. getsebool shows boolean values. sestatus shows more detailed status including mode and policy. seinfo shows policy information.
A containerized application uses a volume to persist data. The administrator needs to create a new volume named 'data-vol' and mount it to /app/data in the container. Which of the following commands accomplish this? (Select all that apply.)
Correct. The `--mount` flag with `type=volume` automatically creates the volume if it does not exist and mounts it to the container.
Why this answer
Both options A and C are correct because they create the volume automatically if it doesn't exist and mount it to the container. The `--mount` flag (option A) uses a more explicit syntax compared to the `-v` flag (option C), but both achieve the same result. Option B is incorrect because the leading slash in `/data-vol` causes a bind mount from the host, not a named volume.
Option D is incorrect because it uses two separate commands (`docker volume create` and `docker run`), while the question asks for a single command that both creates and mounts the volume.
Which command can be used to generate an SSH key pair for user authentication?
ssh-keygen generates SSH key pairs.
Why this answer
The `ssh-keygen` command is the standard tool for generating SSH key pairs (public and private keys) used for user authentication. It creates RSA, ECDSA, Ed25519, or DSA key files (e.g., `~/.ssh/id_rsa` and `~/.ssh/id_rsa.pub`) and supports options like `-t` for key type and `-b` for bit length, directly enabling passwordless login via public key authentication.
Exam trap
The trap here is that candidates confuse `ssh-keygen` (key generation) with `ssh-copy-id` (key deployment) or `ssh-add` (key loading), leading them to pick a command that manages existing keys rather than creating new ones.
How to eliminate wrong answers
Option A is wrong because `ssh-keyscan` is used to gather SSH public host keys from remote servers, not to generate user key pairs. Option C is wrong because `ssh-copy-id` installs an existing public key onto a remote server's `authorized_keys` file, but does not generate keys itself. Option D is wrong because `ssh-add` adds private key identities to the SSH authentication agent (`ssh-agent`), but it cannot create new key pairs.
A technician needs to check which package provides the file /usr/bin/foo on a CentOS 8 system. Which command should be used?
-qf queries the package that owns the file.
Why this answer
On RPM-based systems, rpm -qf queries the package that owns a given file.
A Linux server with systemd is experiencing boot issues after a recent kernel update. Which command sequence should be used to boot into the previous kernel version?
Allows selection of a specific kernel version from the GRUB menu.
Why this answer
GRUB (Grand Unified Bootloader) stores multiple kernel versions in its menu. By interrupting the boot process and selecting 'Advanced options for Ubuntu' (or similar), you can choose the previous kernel entry, which loads the older kernel and its associated initramfs. This is the standard method to recover from a failed kernel update on systems using systemd and GRUB.
Exam trap
The trap here is that candidates confuse changing the default boot target (runlevel) with selecting a different kernel version, or they assume a package manager command can revert the running kernel without understanding that the bootloader controls which kernel is loaded at startup.
How to eliminate wrong answers
Option A is wrong because 'rpm -Uvh --oldkernel' is not a valid RPM command; RPM does not have an '--oldkernel' flag, and booting from a live CD to revert a kernel is an overly complex, non-standard approach that does not leverage the bootloader. Option C is wrong because 'systemctl set-default multi-user.target' changes the default systemd target (runlevel) to multi-user mode, which does not affect which kernel is loaded; it only controls the services started after boot. Option D is wrong because 'grub2-set-default' sets the default boot entry for future boots, but the question asks for a command sequence to boot into the previous kernel *now* during the current boot process, not to change the default for subsequent reboots.
Correctly adds the service permanently and reloads.
A user reports being unable to log in because the password is locked. The administrator needs to unlock the account. Which command should be used?
Correct: -u unlocks the account.
Why this answer
passwd -u unlocks a locked account. usermod -U also works. Among options, passwd -u is correct.
A Linux administrator is troubleshooting a service that fails to start. Which THREE files or commands should be checked to diagnose the issue? (Select THREE.)
Shows service-specific logs from journald.
Why this answer
B is correct because `journalctl -u service-name` displays the systemd journal logs specifically for that service, which includes detailed error messages, timestamps, and status changes that are essential for diagnosing why the service failed to start. This command is the primary tool for viewing service-specific logs in modern systemd-based Linux distributions.
Exam trap
CompTIA often tests the distinction between kernel-level logs (dmesg) and service-level logs (journalctl), and the trap here is that candidates may confuse `dmesg` with service troubleshooting because it shows boot-time messages, but it does not capture service-specific failures.
Which command would display the disk usage of each file and directory in /home in a human-readable format, but only showing one level deep?
Correct: one level deep, human-readable.
Why this answer
du -h --max-depth=1 /home shows human-readable sizes for each item one level deep.
A Linux administrator needs to view the contents of a compressed log file without decompressing it. Which command should be used?
zcat reads compressed files and outputs to stdout.
Why this answer
zcat reads compressed files and outputs the contents to stdout without decompressing them to disk.
A Linux server fails to boot and drops into a GRUB prompt. The administrator needs to boot into single-user mode to repair the system. Which GRUB command should be added to the kernel line temporarily?
Adding 'single' boots into single-user mode.
Why this answer
Adding 'single' to the kernel boot parameters boots into single-user mode.
A user reports that they cannot write files to their home directory. The administrator runs `ls -ld /home/user` and sees 'drwxr-xr-x'. Which command will allow the user to write to the directory?
Changes ownership to the user, granting write permission.
Why this answer
The directory /home/user has permissions drwxr-xr-x, meaning the owner has rwx, group has r-x, and others have r-x. Since the user is not the owner (the owner is likely root), they cannot write. Option B (chown user:user /home/user) changes ownership to the user, granting them write access via the owner's w permission.
Exam trap
Linux+ often tests the misconception that changing permissions (chmod) is always the solution, but here the issue is ownership, not permission bits; candidates may overlook that the user is not the owner and incorrectly choose chmod 755 or 644.
How to eliminate wrong answers
Option A is wrong because chmod 644 sets permissions to rw-r--r--, which removes the execute (x) permission from the owner, making the directory non-accessible (cannot cd into it) and still does not grant write to the user if they are not the owner. Option C is wrong because usermod -aG user /home/user attempts to add a group named 'user' to the user, but /home/user is a directory, not a group; the command syntax is incorrect and does not change directory permissions. Option D is wrong because chmod 755 sets permissions to rwxr-xr-x, which is identical to the current permissions and does not change anything.
Option E is wrong because setfacl -m u:user:rwx /home/user would work to grant the user write access, but it is not the command listed as correct; the question asks which command will allow the user to write, and while this could work, it is not the most direct fix given the current ownership issue, and the correct answer is B.
A Linux administrator is writing a systemd service unit file. Which three of the following directives are valid in the [Service] section? (Select THREE.)
Controls restart behavior of the service process.
Why this answer
A is correct because `Restart` is a valid directive in the `[Service]` section of a systemd service unit file. It controls whether and how the service is restarted when it exits, with common values like `always`, `on-failure`, or `no`. This directive is essential for ensuring service resilience in production environments.
Exam trap
CompTIA often tests the distinction between `[Unit]` and `[Service]` section directives, and the trap here is that candidates mistakenly apply dependency or ordering directives like `After` or `Requires` to the `[Service]` section, when they are only valid in `[Unit]`.
An administrator wants to view the last 20 lines of a log file and continue to watch for new entries. Which command should be used?
tail -f shows the last 10 lines by default and follows, but does not meet the 20-line requirement without adding -n20.
Why this answer
The command tail -f follows a file and continues to display new entries as they are appended. Although tail -f by default shows only the last 10 lines, it is the only listed option that meets the 'continue to watch' requirement. To view exactly the last 20 lines while following, the full command would be tail -n 20 -f (or tail -20f), but among the provided options, tail -f is the correct choice.
Exam trap
Candidates often assume tail -20 will continue to watch for new entries, but the -20 option only sets the line count and does not enable follow mode. The -f flag is required to keep watching the file.
Which command displays the current default umask value for a user?
Running umask alone shows the current value.
Why this answer
The umask command without arguments prints the current umask value.
Match each Linux runlevel to its standard systemd target.
Drag a concept onto its matching description — or click a concept then click the description.
poweroff.target
rescue.target
multi-user.target
graphical.target
reboot.target
Why these pairings
Systemd targets align with traditional SysV runlevels: runlevel 0 → poweroff.target, runlevel 1 → rescue.target, runlevel 2/3/4 → multi-user.target, runlevel 5 → graphical.target, runlevel 6 → reboot.target. Common confusions involve mixing up GUI and non-GUI targets or confusing runlevels for shutdown/reboot.
A security policy requires that user home directories have permissions set so that only the owner has access. A new user 'john' has a home directory with permissions 755. Which command should the administrator run to enforce the policy?
Sets owner rwx, group/others ---, correct.
Why this answer
The security policy requires that only the owner has access to the home directory. The current permissions 755 grant read and execute access to the group and others. The chmod 700 command sets permissions to rwx------, which gives the owner full access and removes all permissions for the group and others, enforcing the policy.
Exam trap
CompTIA often tests the difference between 700 and 750, where candidates mistakenly think group read access is acceptable, but the policy explicitly requires 'only the owner has access', meaning no group or other permissions at all.
How to eliminate wrong answers
Option A is wrong because chmod 711 sets permissions to rwx--x--x, which still allows group and others to execute (and read for the owner), violating the policy that only the owner has access. Option C is wrong because chmod 770 sets permissions to rwxrwx---, which grants full access to the group, violating the policy. Option D is wrong because chmod 750 sets permissions to rwxr-x---, which gives read and execute access to the group, violating the policy.
A system administrator needs to configure PAM to lock a user account after 5 failed login attempts for 15 minutes. Which two PAM modules and configuration lines are appropriate? (Select TWO.)
pam_tally2 can also be used for account lockout with similar options.
Why this answer
pam_faillock can be used to lock accounts after failed attempts. The 'deny' option sets the threshold, and 'unlock_time' sets the lockout duration. Alternatively, pam_tally2 can be used with similar options.
A technician needs to troubleshoot a system that is not booting. Which of the following is the most appropriate first step when using a rescue environment?
This is the standard procedure to access the installed system from the rescue environment.
Why this answer
When using a rescue environment, the first priority is to gain access to the system's configuration and log files by mounting the root filesystem. Mounting to /mnt/sysimage (a conventional mount point in Red Hat-based rescue modes) allows the technician to chroot into the environment and treat it as the running system, enabling further troubleshooting steps like checking logs or repairing the bootloader. This step is foundational because without the root filesystem mounted, commands like checking logs or running fsck cannot operate on the actual system data.
Exam trap
The trap here is that candidates often jump to checking logs or running fsck first, not realizing that without mounting the root filesystem, those actions are either impossible or operate on the rescue environment's own filesystem rather than the broken system's data.
How to eliminate wrong answers
Option B is wrong because checking system logs in /var/log/messages requires the root filesystem to be mounted first; without mounting, the logs are inaccessible from the rescue environment. Option C is wrong because running fsck on all partitions prematurely can cause data corruption if filesystems are already mounted or if the root filesystem is not yet accessible; fsck should be run after mounting and only on unmounted or read-only partitions as needed. Option D is wrong because reinstalling the bootloader immediately is a drastic step that should only be taken after diagnosing the actual cause of the boot failure, such as a corrupted bootloader configuration or missing kernel; doing so without mounting the root filesystem may overwrite critical boot data without understanding the underlying issue.
Practice XK0-006 by domain
Target a specific domain to shore up weak areas.