Courseiva

CompTIA Linux+ (XK0-006) (XK0-006) — Questions 301–375

979 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 4

Page 5 of 14

Page 6
301
MCQmedium

A DevOps engineer is writing a Dockerfile. The application requires environment variables to be set at runtime from a file. Which Dockerfile instruction should be used to achieve this?

A.CMD export
B.ARG
C.ENV
D.RUN export
AnswerC

ENV sets environment variables in the Dockerfile.

Why this answer

The ENV instruction sets environment variables in the Dockerfile, but for runtime from a file, the --env-file option is used with docker run. However, within the Dockerfile, ENV is the instruction to set environment variables.

Full explanation →
302
MCQmedium

A security audit reveals that the /var/log directory has permissions 777. Which command should restore secure permissions, assuming the owner is root and group is adm?

A.chmod 777 /var/log
B.chmod 755 /var/log
C.chmod 700 /var/log
D.chmod 750 /var/log
AnswerB

Sets permissions to rwxr-xr-x, appropriate for a shared log directory.

Why this answer

/var/log typically contains sensitive system logs, and permissions of 755 (owner: rwx, group: r-x, others: r-x) allow the root owner full access, the adm group read/execute access (needed for log reading tools), and others read-only access without write permissions. This aligns with security best practices where only root should write to /var/log, and the 777 permission from the audit is overly permissive and a security risk.

Exam trap

The trap here is that candidates may choose 750 thinking it is more secure, but the XK0-005 exam expects the standard Linux permission of 755 for /var/log to maintain compatibility with common log-reading utilities and the adm group's intended read access.

How to eliminate wrong answers

Option A is wrong because it sets permissions to 777, which is the exact insecure permission the audit flagged, granting write access to everyone and defeating the purpose of restoring secure permissions. Option C is wrong because 700 (owner: rwx, group: ---, others: ---) would deny the adm group any access, breaking legitimate log-reading utilities like syslog or logrotate that require group read/execute permissions. Option D is wrong because 750 (owner: rwx, group: r-x, others: ---) would deny all access to 'others', which may be too restrictive if non-root processes (e.g., monitoring agents) need read access to logs, though it is more secure than 777; however, the standard secure permission for /var/log is 755 to allow others read-only access without write.

Full explanation →
303
MCQeasy

Which directory in the Filesystem Hierarchy Standard (FHS) contains variable data such as logs and spool files?

A./opt
B./etc
C./var
D./tmp
AnswerC

/var contains variable data like logs.

Why this answer

/var is designated for variable data that changes frequently, such as logs, spool directories, and temporary files.

Full explanation →
304
Multi-Selectmedium

Which THREE are best practices for securing a Linux server? (Choose exactly three.)

Select 3 answers
A.Use a host-based firewall
B.Keep software up to date
C.Enable root SSH login with password
D.Disable unnecessary services
E.Set default umask to 0777
AnswersA, B, D

Controls network access to the server.

Why this answer

A host-based firewall (e.g., iptables, nftables, or firewalld) controls incoming and outgoing traffic at the server level, enforcing least-privilege network access. By default, it can block all traffic except explicitly allowed services (e.g., SSH on port 22, HTTPS on port 443), reducing the attack surface. This is a fundamental security control to prevent unauthorized network connections.

Exam trap

CompTIA often tests the misconception that a permissive umask (like 0777) is secure because it 'blocks everything,' but in reality, umask subtracts permissions, so 0777 actually removes all permissions, which is not a best practice and can cause operational issues; the trap is confusing umask subtraction with direct permission setting.

Full explanation →
305
MCQmedium

An administrator needs to permanently mount an ext4 filesystem on /dev/sdb1 to the /data directory. Which file must be edited to ensure the mount persists across reboots?

A./etc/sysconfig/network
B./etc/default/grub
C./etc/fstab
D./etc/mtab
AnswerC

Correct: /etc/fstab is the filesystem table for permanent mounts.

Why this answer

/etc/fstab contains filesystem mount points and options that are automatically mounted at boot.

Full explanation →
306
MCQeasy

The sysadmin receives the error shown in the exhibit. What is the most likely fix?

A.Add a readiness probe to the container.
B.Change the image tag to :latest.
C.Remove the requests section.
D.Add limits to the resources section.
AnswerD

The error explicitly requires limits to be specified.

Why this answer

The error indicates the container was killed due to an Out Of Memory (OOM) condition. Adding limits to the resources section constrains the container's memory usage, preventing it from exceeding the node's capacity and being terminated by the kernel OOM killer.

Exam trap

The trap here is that candidates confuse resource requests (which guarantee minimum resources) with limits (which cap usage), and mistakenly think removing requests or adding probes will fix an OOM error, when only a memory limit prevents the container from exhausting node memory.

How to eliminate wrong answers

Option A is wrong because a readiness probe checks if a container is ready to serve traffic, not memory limits; it does not prevent OOM kills. Option B is wrong because changing the image tag to :latest does not affect resource constraints and may introduce untested versions, but does not fix memory exhaustion. Option C is wrong because removing the requests section removes the minimum resource guarantee but does not cap memory usage; without limits, the container can still consume all available memory and be OOM-killed.

Full explanation →
307
MCQeasy

An administrator wants to use Ansible to ensure that the `httpd` package is installed on all managed nodes. Which Ansible module should be used?

A.copy
B.command
C.yum
D.service
AnswerC

The yum module installs, removes, or upgrades packages using the yum package manager.

Why this answer

The `yum` module is the correct choice because it is a dedicated Ansible module for managing packages on Red Hat-based systems using the YUM package manager. It ensures the `httpd` package is installed by setting the `state: present` parameter, and it handles idempotency by checking the package status before making changes.

Exam trap

The trap here is that candidates may confuse the `service` module (which manages service state) with package installation, or mistakenly think the `command` module is acceptable for package management despite its lack of idempotency and error handling.

How to eliminate wrong answers

Option A is wrong because the `copy` module is used to copy files from the local machine to remote nodes, not to install packages. Option B is wrong because the `command` module runs arbitrary commands but lacks idempotency and package-specific features, making it error-prone for package management. Option D is wrong because the `service` module manages the state of services (e.g., started, stopped), not the installation of packages.

Full explanation →
308
MCQhard

A container started with the above Compose configuration fails to set the system time (clock_settime syscall). Which additional capability is required?

A.SYS_NICE
B.SYS_TIME
C.SYS_RESOURCE
D.SYS_CLOCK
AnswerB

Required for changing the system clock.

Why this answer

The `clock_settime` syscall requires the `SYS_TIME` capability to modify the system clock. In Docker Compose, capabilities are added via the `cap_add` directive, and without `SYS_TIME`, the container lacks the privilege to change the system time, resulting in a failure.

Exam trap

CompTIA often tests the distinction between `SYS_TIME` and the non-existent `SYS_CLOCK` to trap candidates who assume a capability name must match the syscall name exactly.

How to eliminate wrong answers

Option A is wrong because `SYS_NICE` allows changing process priority and scheduling, not system time. Option C is wrong because `SYS_RESOURCE` controls resource limits (e.g., ulimit overrides), not clock operations. Option D is wrong because `SYS_CLOCK` is not a valid Linux capability; the correct capability for clock operations is `SYS_TIME`.

Full explanation →
309
MCQmedium

A system administrator notices that a process with PID 1234 is consuming excessive CPU. The administrator wants to terminate this process gracefully. Which command should be used?

A.killall 1234
B.kill 1234
C.pkill -9 1234
D.kill -9 1234
AnswerB

Default signal is SIGTERM (15), which requests graceful termination.

Why this answer

kill sends a signal; by default it sends SIGTERM (15), which asks the process to terminate gracefully. SIGKILL (9) is forceful.

Full explanation →
310
MCQeasy

A Linux administrator needs to automate daily database backups and ensure the job runs even if the system is rebooted. Which approach should be used?

A.Schedule the backup using the at command.
B.Add a cron job in /etc/crontab.
C.Create a systemd timer unit that triggers a service.
D.Use anacron to run the job daily.
AnswerC

Timers can catch up after reboot.

Why this answer

A systemd timer unit is the correct approach because it can be configured to trigger a service unit (e.g., a backup script) on a daily schedule, and systemd ensures that timers persist across reboots and will catch up on missed runs if the system was down. This provides reliable, dependency-aware scheduling integrated with the init system, unlike cron which may miss jobs during downtime.

Exam trap

The trap here is that candidates often default to cron (option B) for recurring tasks, but the requirement 'even if the system is rebooted' specifically tests knowledge of systemd timers' persistent and catch-up capabilities, which cron lacks.

How to eliminate wrong answers

Option A is wrong because the `at` command schedules a one-time job, not a recurring daily task, and does not automatically re-run after a reboot. Option B is wrong because a cron job in /etc/crontab runs only when the system is powered on at the scheduled time; if the system is rebooted or down during that time, the job is missed entirely without catch-up logic. Option D is wrong because anacron is designed for systems that are not running 24/7, but it does not integrate with systemd's service management and is not the recommended modern approach for ensuring a job runs after a reboot on a systemd-based Linux distribution.

Full explanation →
311
Multi-Selecthard

A system administrator is troubleshooting why a user cannot execute a script in their home directory. Which TWO conditions could prevent execution? (Choose two.)

Select 2 answers
A.The script is owned by a different user
B.The user's umask is set to 022
C.The script does not have the execute permission set for the user
D.The filesystem containing the script is mounted with the noexec option
E.The script is interpreted by a shell that is not listed in /etc/shells
AnswersC, D

Without execute permission, the script cannot be run.

Why this answer

For a user to execute a script, the file must have the execute permission bit set for that user (or for the group or others, depending on the user's relationship to the file). Without the execute permission (e.g., `chmod +x`), the shell will refuse to run the script directly, returning a 'Permission denied' error. Option D is correct because if the filesystem is mounted with the noexec option, no files on that filesystem can be executed, regardless of permissions.

Option E is incorrect because /etc/shells is only used to validate login shells; it does not affect script execution. The interpreter for a script is determined by the shebang line, and the system will attempt to run it regardless of whether it's listed in /etc/shells. Options A and B are incorrect: file ownership does not directly prevent execution as long as the user has appropriate permissions, and umask only affects default permissions of newly created files, not existing ones.

Exam trap

Common pitfalls include thinking that file ownership, umask, or the /etc/shells file prevent execution. In reality, the two key blockers are: absence of execute permission and the noexec mount option. Many candidates mistakenly believe that a shell must be listed in /etc/shells for script execution, but that file is only used for login shells.

Full explanation →
312
Multi-Selecteasy

A container produces a large amount of log output to stdout. Which TWO methods effectively manage log size in a production environment?

Select 2 answers
A.Use docker logs --tail 100 to limit output
B.Configure journald limits for container logging
C.Use a bind mount to redirect logs to /dev/null
D.Configure the application inside the container to log to a file
E.Set the --log-opt max-size=10m when running the container
AnswersB, E

Journald can be configured to cap log storage for containers.

Why this answer

Journald can be configured to limit the size of log data it stores, including container logs that are sent to the journal. In a production environment, setting `SystemMaxUse=` or `MaxRetentionSec=` in `/etc/systemd/journald.conf` prevents unbounded log growth. Option E is correct because Docker's `--log-opt max-size=10m` truncates the container's log file when it reaches 10 MB, rotating it automatically, which directly manages log size at the container runtime level.

Exam trap

The trap here is that candidates confuse `docker logs --tail` (a display filter) with actual log size management, or assume that redirecting logs to `/dev/null` is a valid production strategy, when in fact it destroys forensic data and violates operational best practices.

Full explanation →
313
MCQhard

A Linux administrator is writing a Bash script to automate the backup of a database. The script must run a pre-backup command, check its exit status, and if successful, proceed with the backup; otherwise, log an error and exit. Which code snippet correctly implements this logic?

A.set -e pre_backup_cmd backup_cmd
B.pre_backup_cmd && backup_cmd || echo 'Error' >&2
C.pre_backup_cmd if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi backup_cmd
D.(pre_backup_cmd; if [ $? -ne 0 ]; then echo 'Error' >&2; exit 1; fi) && backup_cmd
AnswerC

This correctly captures the exit status of the pre_backup_cmd and handles failure before proceeding.

Why this answer

Ly runs the pre-backup command, then checks its exit status with `$?`. If the exit status is not zero (indicating failure), it logs an error to stderr and exits with code 1. Only if the pre-backup command succeeds does the script proceed to the backup command.

This matches the requirement exactly: check exit status, log error on failure, and exit.

Exam trap

The trap here is that candidates often choose option B because they think `&&` and `||` provide equivalent conditional logic, but they overlook that the `||` will also catch failures from the backup command itself, not just the pre-backup command, violating the requirement.

How to eliminate wrong answers

Option A is wrong because `set -e` causes the script to exit immediately on any command failure, but it does not log an error message before exiting, nor does it allow conditional logic to proceed with backup only on success. Option B is wrong because the `||` after `backup_cmd` will also trigger the error logging if `backup_cmd` itself fails, even if `pre_backup_cmd` succeeded — this does not match the requirement to only log an error when the pre-backup command fails. Option D is wrong because the subshell `( ... )` runs the pre-backup command and error handling inside a child shell; if the pre-backup command fails, the `exit 1` inside the subshell only exits the subshell, not the main script, and the `&& backup_cmd` will not run, but the main script continues without exiting — failing to meet the requirement to exit the script on pre-backup failure.

Full explanation →
314
MCQeasy

A Linux administrator needs to change the permissions of a file to allow the owner to read and write, the group to read only, and others to have no access. Which chmod command should be used?

A.chmod 640 file
B.chmod 600 file
C.chmod 755 file
D.chmod 644 file
AnswerA

Correct: 640 sets rw-r-----.

Why this answer

The symbolic representation rw-r----- corresponds to octal 640. rw- = 4+2+0=6, r-- = 4+0+0=4, --- = 0+0+0=0.

Full explanation →
315
MCQeasy

Which of the following correctly describes the purpose of the /etc/shadow file?

A.It stores the list of users who can use sudo.
B.It stores group memberships and group passwords.
C.It stores user account information including UID, GID, and shell.
D.It stores encrypted passwords and password aging fields.
AnswerD

Correct.

Why this answer

The /etc/shadow file stores encrypted (hashed) user passwords and password aging information such as the date of last password change, minimum/maximum password age, and account expiration. This file is readable only by root to protect password hashes from unauthorized access, unlike /etc/passwd which is world-readable.

Exam trap

The trap here is that candidates confuse the purpose of /etc/shadow with /etc/passwd, mistakenly thinking /etc/shadow stores UID, GID, and shell, when in fact those are in /etc/passwd and /etc/shadow specifically holds password hashes and aging data.

How to eliminate wrong answers

Option A is wrong because the list of users who can use sudo is stored in /etc/sudoers (or /etc/sudoers.d/), not in /etc/shadow. Option B is wrong because group memberships and group passwords are stored in /etc/group and /etc/gshadow, not in /etc/shadow. Option C is wrong because user account information including UID, GID, and shell is stored in /etc/passwd, not in /etc/shadow.

Full explanation →
316
MCQeasy

A junior administrator is asked to automate the backup of a configuration file every night at 11 PM. The script /usr/local/bin/backup.sh already exists. Which command should the administrator run to schedule this task?

A.systemctl start backup.timer
B.at 23:00 /usr/local/bin/backup.sh
C.echo "0 23 * * * /usr/local/bin/backup.sh" | crontab -
D.nohup /usr/local/bin/backup.sh &
AnswerC

Correct. This appends a cron job entry to the crontab, scheduling the script to run daily at 23:00.

Why this answer

The `crontab -` command reads from standard input and installs the cron job. The line `0 23 * * * /usr/local/bin/backup.sh` specifies that the script should run at 23:00 (11 PM) every day, matching the requirement exactly. This is the standard method for scheduling recurring tasks in Linux using cron.

Exam trap

The trap here is that candidates often confuse `at` (for one-time tasks) with `cron` (for recurring tasks), or assume `systemctl start` can create a timer on the fly without a pre-existing timer unit file.

How to eliminate wrong answers

Option A is wrong because `systemctl start backup.timer` would start a systemd timer unit, but no such timer has been defined or enabled; this command does not create a new schedule and would fail if the timer unit does not exist. Option B is wrong because the `at` command is used for one-time scheduled tasks, not recurring nightly backups; `at 23:00` would schedule the script to run only once at the next 11 PM, not every night. Option D is wrong because `nohup` runs the script in the background with immunity to hangups, but it does not schedule the task for a future time; it executes immediately and exits.

Full explanation →
317
MCQhard

An administrator is writing a bash script that loops through all .log files in /var/log and prints the file name if the file is larger than 100 kilobytes. Which loop correctly implements this?

A.ls -l /var/log/*.log | awk '$5>100 {print $NF}'
B.for f in /var/log/*.log; do if [ -s $f -a $(stat -c%s $f) -gt 100 ]; then echo $f; fi; done
C.find /var/log -name '*.log' -size +100k -exec echo {} \;
D.for f in /var/log/*.log; do if [ $f -gt 100k ]; then echo $f; fi; done
AnswerC

Correct. find with -size +100k matches files larger than 100 kilobytes.

Why this answer

The find command with -size filters files larger than 100k, and -exec with {} runs the command for each file. The other options have syntax errors or incorrect logic.

Full explanation →
318
MCQmedium

A user is able to ping the Linux server but cannot connect via SSH. The SSH service is running and listening. Which configuration file should the administrator review FIRST?

A./etc/pam.d/login
B./etc/ssh/sshd_config
C./etc/nsswitch.conf
D./etc/hosts.allow
AnswerB

Contains authentication methods and other critical settings.

Why this answer

The SSH service is running and listening, but the user cannot connect. This points to a configuration issue within the SSH daemon itself. The `/etc/ssh/sshd_config` file controls SSH server settings such as allowed authentication methods, port numbers, and user access restrictions (e.g., `AllowUsers`, `DenyUsers`, `PermitRootLogin`).

Reviewing this file first is the logical step to identify why connections are being rejected despite the service being active.

Exam trap

The trap here is that candidates often jump to `/etc/hosts.allow` or PAM files because they associate 'cannot connect' with access control or authentication, but the question specifies the service is running and listening, which narrows the issue to SSH-specific configuration in `sshd_config`.

How to eliminate wrong answers

Option A is wrong because `/etc/pam.d/login` is used for local console login authentication via PAM, not for SSH connections; SSH uses its own PAM service file (e.g., `/etc/pam.d/sshd`) if PAM is enabled. Option C is wrong because `/etc/nsswitch.conf` controls name service resolution order (e.g., files, DNS, LDAP) and does not affect SSH connectivity or authentication. Option D is wrong because `/etc/hosts.allow` is part of the TCP Wrappers system (libwrap), which is deprecated and not used by modern SSH daemons; SSH typically does not consult this file unless explicitly compiled with libwrap support, which is rare in current distributions.

Full explanation →
319
MCQmedium

A Linux server is configured to allow SSH access for remote administration. The security team wants to limit SSH access to only users in the 'ssh-users' group. Which configuration should be added to /etc/ssh/sshd_config?

A.AllowUsers ssh-users
B.AllowGroups ssh-users
C.DenyUsers root
D.PermitRootLogin yes
AnswerB

AllowGroups restricts SSH to group members.

Why this answer

The AllowGroups directive in /etc/ssh/sshd_config restricts SSH logins to only those users who are members of the specified group. By setting 'AllowGroups ssh-users', only users belonging to the 'ssh-users' group will be permitted to authenticate via SSH, directly fulfilling the security team's requirement.

Exam trap

The trap here is that candidates confuse AllowUsers (which takes usernames) with AllowGroups (which takes group names), leading them to incorrectly select option A thinking it will filter by group membership.

How to eliminate wrong answers

Option A is wrong because AllowUsers expects a list of usernames, not a group name; 'AllowUsers ssh-users' would attempt to match a user literally named 'ssh-users', not members of the group. Option C is wrong because 'DenyUsers root' only blocks the root user from SSH access, but does nothing to limit access to only users in the 'ssh-users' group. Option D is wrong because 'PermitRootLogin yes' controls whether root can log in via SSH, not which users or groups are allowed; it is irrelevant to restricting access to a specific group.

Full explanation →
320
Multi-Selectmedium

A system administrator is writing a bash script that must check if a file exists and is readable before processing. Which TWO test expressions can be used in an if statement? (Select TWO.)

Select 2 answers
A.[ -e /path/to/file ]
B.[ -f /path/to/file ]
C.[ -x /path/to/file ]
D.[ -s /path/to/file ]
E.[ -r /path/to/file ]
AnswersA, E

Correct. -e checks if file exists.

Why this answer

The -e test checks existence, and -r checks readability. Other options are for different attributes.

Full explanation →
321
MCQhard

A Linux administrator is writing a script that must wait for a background process to finish before continuing. The process ID is stored in a variable. Which command should be used to wait for this process?

A.sleep 10
B.wait
C.wait $PID
D.kill -0 $PID
AnswerC

Waits for specific process.

Why this answer

The `wait` command in Bash, when given a specific process ID (PID), suspends execution of the calling shell script until that background process terminates. This directly fulfills the requirement to wait for a specific background process whose PID is stored in a variable.

Exam trap

CompTIA often tests the distinction between `wait` (which waits for process completion) and `kill -0` (which only checks process existence), leading candidates to mistakenly choose `kill -0` as a waiting mechanism.

How to eliminate wrong answers

Option A is wrong because `sleep 10` simply pauses execution for a fixed 10 seconds, regardless of whether the background process has finished, and does not use the stored PID. Option B is wrong because `wait` without arguments waits for all background processes to finish, not a specific process identified by the PID variable. Option D is wrong because `kill -0 $PID` only checks whether a process with that PID exists and is accessible, sending no signal; it does not wait for the process to complete.

Full explanation →
322
MCQeasy

An administrator wants to enforce an account lockout policy after five failed login attempts on a Linux system. Which PAM module should be added to the authentication stack?

A.pam_faillock.so
B.pam_unix.so
C.pam_pwquality.so
D.pam_tally2.so
AnswerA

pam_faillock locks accounts after a defined number of failures.

Why this answer

pam_faillock is used for account lockout after failed attempts. pam_unix handles authentication, pam_pwquality checks password strength, pam_tally2 is an older module.

Full explanation →
323
MCQeasy

Which command displays the amount of free and used disk space on all mounted file systems in a human-readable format?

A.du -h /
B.lsblk -h
C.mount -h
D.df -h
AnswerD

Correct: df -h shows free/used space.

Why this answer

df -h shows disk space in human-readable units. du shows disk usage per directory; lsblk lists block devices; mount shows mounted filesystems but not space usage.

Full explanation →
324
MCQhard

In a Bash script, the administrator wants to capture the output of a command into a variable. Which syntax should be used?

A.$VAR
B.$((command))
C.`command`
D.$(command)
AnswerD

Correct. $(command) is the modern syntax for command substitution, capturing the command's stdout into a variable.

Why this answer

Command substitution can be done with $(command) or backticks `command`. The latter is deprecated. $(( )) is for arithmetic expansion. $VAR is for variable expansion.

Full explanation →
325
MCQhard

A system administrator configures PAM to enforce account lockout after 3 failed login attempts. Which PAM module should be used?

A.pam_faillock
B.pam_pwquality
C.pam_securetty
D.pam_unix
AnswerA

pam_faillock manages account lockout based on failed attempts.

Why this answer

pam_faillock is the correct PAM module for enforcing account lockout after a specified number of failed login attempts. It tracks failed authentication attempts per user and can lock the account when the threshold (e.g., 3 attempts) is reached, typically by writing to a tally file like /var/log/faillock.

Exam trap

The trap here is that candidates may confuse pam_faillock with pam_tally2 (a legacy module) or assume pam_unix alone can enforce lockout, but pam_unix lacks built-in lockout tracking and requires pam_faillock or pam_tally2 for that feature.

How to eliminate wrong answers

Option B (pam_pwquality) is wrong because it enforces password quality rules (e.g., length, complexity) during password changes, not account lockout after failed logins. Option C (pam_securetty) is wrong because it restricts root login to terminals listed in /etc/securetty, not lockout policies. Option D (pam_unix) is wrong because it handles standard Unix authentication (e.g., verifying passwords via /etc/shadow) but does not provide account lockout functionality on its own.

Full explanation →
326
MCQeasy

A security engineer needs to verify the authenticity of a downloaded file using its detached GPG signature (file.sig). Which command should be used?

A.gpg --sign file
B.gpg --list-keys
C.gpg --verify file.sig
D.gpg --decrypt file.gpg
AnswerC

This command verifies the detached signature file.sig against the original file (file).

Why this answer

The `gpg --verify file.sig` command is used to verify the authenticity of a file using its detached GPG signature. The detached signature file (file.sig) contains the cryptographic signature, and GPG checks it against the original file (which must be present in the same directory with the same base name) using the signer's public key from the local keyring. This confirms that the file was signed by the holder of the corresponding private key and has not been tampered with.

Exam trap

CompTIA often tests the distinction between detached signatures and embedded signatures, where candidates mistakenly think `--verify` requires the original file as an argument, but GPG automatically infers it from the signature filename.

How to eliminate wrong answers

Option A is wrong because `gpg --sign file` creates a new signature for the file, not verify an existing one. Option B is wrong because `gpg --list-keys` lists public keys in the keyring but does not perform any verification. Option D is wrong because `gpg --decrypt file.gpg` decrypts an encrypted file, not verify a detached signature.

Full explanation →
327
MCQmedium

A Linux system fails to boot, and the administrator wants to access a minimal environment to repair the system. Which systemd target should be specified in the kernel command line to achieve this?

A.emergency.target
B.rescue.target
C.multi-user.target
D.graphical.target
AnswerB

Rescue.target is a single-user mode for maintenance.

Why this answer

The rescue.target provides a minimal environment for system recovery.

Full explanation →
328
MCQmedium

Which command displays the number of lines, words, and characters in a file?

A.wc file.txt
B.wc -w file.txt
C.cat file.txt | wc -l
D.stat file.txt
AnswerA

wc displays line, word, and byte counts.

Why this answer

The `wc` command without any options displays the number of lines, words, and characters in a file, in that order. By default, `wc` counts newline characters (lines), whitespace-delimited tokens (words), and bytes (characters) in the specified file. This makes option A the correct choice for displaying all three counts.

Exam trap

The trap here is that candidates often confuse the default behavior of `wc` (which shows all three counts) with options like `-w` or `-l` that only show one metric, or they mistakenly think `stat` provides line/word counts.

How to eliminate wrong answers

Option B is wrong because `wc -w` only counts the number of words in the file, not lines or characters. Option C is wrong because `cat file.txt | wc -l` only counts the number of lines (newline characters) in the file, not words or characters. Option D is wrong because `stat file.txt` displays file metadata such as size, permissions, and timestamps, but does not count lines, words, or characters.

Full explanation →
329
MCQhard

During boot, a Linux system displays a kernel panic indicating 'not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

A.Network configuration error
B.A failed filesystem check due to dirty file system
C.Incorrect GRUB timeout value
D.Missing or corrupt initramfs
AnswerD

The initramfs contains drivers needed to mount the root filesystem; if missing or corrupt, mount fails.

Why this answer

The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates that the kernel cannot locate or access the root filesystem. This is most commonly caused by a missing or corrupt initramfs (initial RAM filesystem), which contains the necessary drivers and modules to mount the root filesystem. Without a valid initramfs, the kernel has no way to load storage drivers (e.g., for SATA, NVMe, or LVM) and thus fails to mount the root device.

Exam trap

Candidates often confuse a 'dirty filesystem' error with the 'unknown-block(0,0)' message; the latter is specifically about the kernel's inability to find the root device due to missing drivers in the initramfs.

How to eliminate wrong answers

Option A is wrong because a network configuration error would not prevent the kernel from mounting the root filesystem; network issues typically cause problems later in the boot process (e.g., during network service startup). Option B is wrong because a failed filesystem check due to a dirty filesystem would produce a different error (e.g., 'fsck failed' or 'mount: wrong fs type') and would not result in an 'unknown-block(0,0)' message, which indicates the block device itself is unrecognized. Option C is wrong because an incorrect GRUB timeout value only affects the boot menu countdown; it does not affect the kernel's ability to locate or mount the root filesystem.

Full explanation →
330
MCQmedium

A user reports that a custom application service fails to start with a 'Permission denied' error in the logs. The service runs under the 'appuser' account. Which is the most likely cause and the first step to diagnose?

A.The root password is incorrect; change root password with passwd.
B.SELinux is blocking the service; check journalctl for AVC denials and use restorecon or setsebool.
C.The service binary does not have execute permission for appuser; use chmod +x.
D.The systemd target is not set to multi-user; run systemctl set-default multi-user.target.
AnswerB

SELinux often causes 'Permission denied' and journalctl shows the denial message.

Why this answer

SELinux enforces mandatory access controls that can block a service from starting even when standard Linux file permissions are correct. The 'Permission denied' error, combined with the service running under a non-root user, strongly suggests SELinux is denying access. Checking journalctl for AVC denials is the standard first diagnostic step to confirm SELinux involvement, followed by using restorecon to fix file context labels or setsebool to adjust SELinux booleans.

Exam trap

The Linux+ exam often tests the distinction between standard Linux file permissions (chmod) and SELinux mandatory access controls, trapping candidates who immediately assume a 'Permission denied' error is due to missing execute bits rather than checking SELinux denials in journalctl.

How to eliminate wrong answers

Option A is wrong because the root password is irrelevant to a service starting under 'appuser'; the error is not about authentication but about access control, and changing the root password would not resolve a 'Permission denied' error in the service logs. Option C is wrong because while missing execute permission could cause a similar error, the question specifies the service 'fails to start' with 'Permission denied' in the logs, and SELinux denials are a far more common cause in modern Linux distributions; chmod +x would be appropriate only if standard file permissions were the issue, but the diagnostic step of checking journalctl for AVC denials is the first recommended action. Option D is wrong because the systemd target setting determines which services start at boot, not whether a specific service can start; a wrong target would prevent the service from starting at boot but would not produce a 'Permission denied' error in the service logs.

Full explanation →
331
MCQmedium

A user reports that a recently installed application fails to start. The application was installed via a shell script that added a repository and installed the package. The user runs 'ldd /usr/bin/app' and sees several 'not found' libraries. Which of the following is the MOST likely cause?

A.The installation script did not install all required dependencies.
B.The kernel version is outdated.
C.SELinux is blocking the application.
D.The file system is corrupted.
AnswerA

The 'not found' libraries indicate missing dependencies, which can occur if the script failed to install all required packages.

Why this answer

The `ldd` command lists shared library dependencies for a binary. When it reports 'not found' libraries, it means the dynamic linker cannot locate the required `.so` files. Since the application was installed via a shell script that added a repository and installed the package, the most likely cause is that the script failed to install all required dependencies, leaving the binary unable to resolve its shared library links.

Exam trap

The trap here is that candidates may confuse library resolution failures with permission or security issues (like SELinux), but `ldd` output directly points to missing files, not access control.

How to eliminate wrong answers

Option B is wrong because an outdated kernel version would not cause specific shared libraries to be missing; it might cause system call incompatibilities, but `ldd` would still find the libraries if they were installed. Option C is wrong because SELinux blocks access based on security contexts, not by making libraries disappear from the filesystem; `ldd` would still resolve the libraries, though execution might be denied. Option D is wrong because file system corruption would likely cause broader system issues or error messages beyond just missing libraries in `ldd` output, and `ldd` would typically report I/O errors or file not found for the binary itself, not specific library dependencies.

Full explanation →
332
MCQeasy

A system administrator needs to restrict SSH access to a Linux server to only users in the 'sshusers' group. Which configuration change achieves this?

A.Add 'DenyUsers *' to /etc/ssh/sshd_config
B.Set 'PermitRootLogin no' in /etc/ssh/sshd_config
C.Add 'AllowGroups sshusers' to /etc/ssh/sshd_config
D.Add 'AllowUsers sshusers' to /etc/ssh/sshd_config
AnswerC

AllowGroups restricts SSH access to members of the specified group.

Why this answer

The 'AllowGroups' directive in /etc/ssh/sshd_config restricts SSH access to only users who are members of the specified group. When set to 'AllowGroups sshusers', only users belonging to the 'sshusers' group will be permitted to log in via SSH, effectively blocking all others. This is the standard method for group-based access control in OpenSSH.

Exam trap

CompTIA often tests the distinction between 'AllowUsers' (which expects usernames) and 'AllowGroups' (which expects group names), leading candidates to incorrectly choose 'AllowUsers sshusers' thinking it applies to the group rather than a user literal.

How to eliminate wrong answers

Option A is wrong because 'DenyUsers *' denies all users by name, but it does not consider group membership; it would block everyone including root and any user, which is overly restrictive and not the intended group-based restriction. Option B is wrong because 'PermitRootLogin no' only disables root login via SSH, but does nothing to restrict access for other users or enforce group-based access control. Option D is wrong because 'AllowUsers sshusers' expects a list of usernames, not a group name; it would attempt to match a user literally named 'sshusers', which does not exist, effectively denying all users but for the wrong reason and without group-based logic.

Full explanation →
333
MCQeasy

The /home partition is nearly full. The administrator wants to increase the size of the home filesystem. Which action should be taken first?

A.Unmount the /home filesystem
B.Use resize2fs on /dev/mapper/vg-home
C.Use lvextend to extend the logical volume
D.Add a new disk to the volume group
AnswerA

Unmounting ensures no writes occur during the resize process, minimizing risk of data corruption.

Why this answer

Before any logical volume or filesystem operations can be performed on a partition that is in use, the filesystem must be unmounted to prevent data corruption and ensure the metadata is in a consistent state. The /home filesystem is actively used by user processes, so unmounting it first is mandatory before resizing or extending the underlying logical volume.

Exam trap

The trap here is that candidates often jump to extending the logical volume (lvextend) or resizing the filesystem (resize2fs) without first unmounting, forgetting that the filesystem must be offline for safe metadata manipulation.

How to eliminate wrong answers

Option B is wrong because resize2fs cannot safely resize a mounted filesystem; it requires the filesystem to be unmounted first to avoid corruption. Option C is wrong because lvextend extends the logical volume, but the filesystem on top must be unmounted before the logical volume can be safely extended and the filesystem resized. Option D is wrong because adding a new disk to the volume group is an unnecessary step when the existing volume group has free space; the immediate prerequisite is unmounting the filesystem.

Full explanation →
334
MCQmedium

A security policy requires that all users must have passwords with at least one uppercase letter, one digit, and a minimum length of 12 characters. Which PAM configuration file and module should be used to enforce this?

A./etc/pam.d/login with pam_securetty.so
B./etc/pam.d/sshd with pam_unix.so
C./etc/pam.d/sudo with pam_permit.so
D./etc/pam.d/common-password with pam_pwquality.so
AnswerD

pam_pwquality.so enforces password complexity rules.

Why this answer

pam_pwquality is used for password complexity requirements. It is typically configured in /etc/pam.d/common-password (or system-auth, password-auth) with options like minlen, ucredit, dcredit.

Full explanation →
335
MCQhard

Refer to the exhibit. A web server is experiencing performance issues. Based on the process list shown, which action should the administrator take first?

A.Increase the PID limit in /proc/sys/kernel/pid_max.
B.Kill the parent process of the zombie (PID 1234).
C.Identify and restart the parent process to clean up the zombie.
D.Terminate the zombie process with SIGKILL.
AnswerC

The zombie's parent (PID 1234 - httpd master) should reap it. Restarting the master process will clean orphans.

Full explanation →
336
MCQeasy

A Linux administrator needs to find large log files that may be consuming disk space. Which command should be used to locate files larger than 100MB in the /var/log directory?

A.df -h
B.ls -lR /var/log
C.find /var/log -type f -size +100M
D.du -sh /var/log/*
AnswerC

Correct: Finds files larger than 100MB.

Why this answer

The `find` command with `-type f` (regular files) and `-size +100M` (files larger than 100 megabytes) is the correct tool to locate large log files in /var/log. This directly meets the requirement to find files by size, unlike other commands that only show disk usage or directory listings without size filtering.

Exam trap

The trap here is that candidates often confuse `du` (disk usage of directories) or `df` (filesystem free space) with `find`'s file-size filtering, leading them to choose options that show aggregate usage rather than locating individual large files.

How to eliminate wrong answers

Option A is wrong because `df -h` reports filesystem-level disk usage (e.g., total, used, available space on mounted partitions), not individual file sizes. Option B is wrong because `ls -lR /var/log` recursively lists all files and directories with details but does not filter by size, requiring manual inspection to find large files. Option D is wrong because `du -sh /var/log/*` shows the total disk usage of each top-level item in /var/log, but it does not filter for files larger than 100MB and may miss files nested deeper in subdirectories.

Full explanation →
337
Multi-Selectmedium

A Linux administrator is investigating a performance issue on a server. The administrator needs to identify which processes are consuming the most CPU and memory, and then adjust their priority. Which TWO commands should the administrator use to accomplish this? (Choose TWO.)

Select 2 answers
A.kill
B.ps
C.top
D.nice
E.renice
AnswersC, E

top displays dynamic real-time information about running processes, including CPU and memory usage.

Why this answer

top shows real-time process information including CPU and memory usage. renice adjusts the priority of running processes.

Full explanation →
338
MCQeasy

A Linux administrator needs to add a new user named 'jdoe' with a home directory and default shell /bin/bash. Which command should be used?

A.chage -m -s /bin/bash jdoe
B.useradd -m -s /bin/bash jdoe
C.passwd -m -s /bin/bash jdoe
D.usermod -m -s /bin/bash jdoe
AnswerB

Correct. useradd with -m creates home directory and -s sets shell.

Why this answer

The useradd command is used to create new users. The -m option creates the home directory, and -s sets the shell. usermod modifies existing users, passwd sets passwords, and chage manages password aging.

Full explanation →
339
MCQeasy

An administrator needs to add a script to be executed daily. The script is placed at /etc/cron.daily/myscript. After placing the script, it does not run. Based on the exhibit, what is the most likely issue?

A.The script is owned by the wrong user
B.The cron daemon is not running
C.The script is not executable
D.The script is not listed in /etc/crontab
E.Anacron is not installed
AnswerC

Scripts must have execute permission to be run by run-parts.

Why this answer

Scripts placed in /etc/cron.daily/ are executed by run-parts, which requires files to have the executable bit set. Without the execute permission (e.g., chmod +x), the script is skipped entirely, even if it is owned correctly and the cron daemon is active.

Exam trap

The trap here is that candidates assume ownership or the cron daemon status is the issue, but the specific requirement for the executable bit on scripts in cron.daily directories is a subtle but frequently tested detail.

How to eliminate wrong answers

Option A is wrong because ownership (typically root) does not prevent execution; the cron daemon runs as root and can execute any owned script as long as it is executable. Option B is wrong because if the cron daemon were not running, no cron jobs would execute at all, but the question indicates only this specific script fails. Option D is wrong because /etc/cron.daily/ is a directory processed by run-parts via /etc/crontab; scripts do not need to be listed individually in /etc/crontab.

Option E is wrong because anacron is used for jobs that may run on systems that are not always on, but it is not required for daily cron execution on a continuously running system.

Full explanation →
340
MCQeasy

A user wants to change the permissions of a file to give the owner full control, the group read and execute, and others no access. Which of the following chmod commands will achieve this?

A.chmod 750 file
B.chmod 700 file
C.chmod 770 file
D.chmod 755 file
AnswerA

Correct: owner rwx, group r-x, others ---.

Why this answer

750 in octal gives rwx (7) to owner, r-x (5) to group, --- (0) to others. Option A is correct. Option B is 700 (rwx------) giving group no access.

Option C is 770 (rwxrwx---) giving group write. Option D is 755 (rwxr-xr-x) giving others read/execute.

Full explanation →
341
Multi-Selecthard

Which TWO commands can be used to immediately synchronize the system time with an NTP server, even if the time difference is large? (Choose two.)

Select 2 answers
A.chronyd -q
B.systemctl restart ntp
C.timedatectl set-ntp true
D.ntpd -g
E.ntpdate pool.ntp.org
AnswersD, E

ntpd -g allows a large time correction on startup.

Why this answer

`ntpd -g` allows the NTP daemon to perform a one-time large time jump (even if the offset exceeds the default panic threshold of 1000 seconds) and then continue normal synchronization. Option E is correct because `ntpdate pool.ntp.org` immediately sets the system clock to the time returned by the NTP server, regardless of the current time difference, making it suitable for large corrections.

Exam trap

The trap here is that candidates often confuse `chronyd -q` (a query option) with `chronyc makestep` (the actual sync command), or assume `timedatectl set-ntp true` performs an immediate sync when it only enables the service.

Full explanation →
342
MCQeasy

Refer to the exhibit. A Linux administrator runs the netstat command to check listening services. The output shows that services are listening on ports 22, 80, and 443. Which of the following conclusions is correct based on the exhibit?

A.The Apache HTTP server is running and listening on both port 80 and port 443
B.The HTTP server is only listening on the loopback interface
C.A firewall is blocking incoming connections to port 443
D.The SSH daemon is configured to listen on a non-standard port
AnswerA

The exhibit shows httpd (Apache) listening on ports 80 and 443.

Why this answer

The netstat output shows services listening on ports 80 and 443, which are the standard ports for HTTP and HTTPS respectively. Apache HTTP server is the most common service that listens on both these ports simultaneously. The fact that both ports are listed as listening indicates that Apache (or another web server) is bound to these ports and ready to accept connections.

Exam trap

CompTIA often tests the distinction between a service listening on a port and a firewall blocking traffic to that port; candidates mistakenly think a listening service means traffic is reaching it, but netstat only shows the socket state, not firewall rules.

How to eliminate wrong answers

Option B is wrong because the netstat output does not show the listening address as 127.0.0.1 or ::1; it shows 0.0.0.0 or a specific IP, meaning it listens on all interfaces, not just loopback. Option C is wrong because netstat shows the service as listening on port 443; a firewall blocking incoming connections would not prevent the service from listening, it would only block inbound packets from reaching the listening socket. Option D is wrong because SSH daemon (sshd) by default listens on port 22, which is the standard port, not a non-standard one.

Full explanation →
343
Multi-Selectmedium

An administrator is investigating a network issue where a server cannot connect to an external website. They run `ping 8.8.8.8` successfully, but `ping google.com` fails. Which TWO of the following are the most likely causes? (Choose TWO.)

Select 2 answers
A.The network interface is down.
B.The default gateway is misconfigured.
C.The DNS server is unreachable or misconfigured.
D.The firewall is blocking ICMP traffic.
E.The /etc/hosts file has an incorrect entry for google.com.
AnswersC, E

DNS resolution fails, so hostname cannot be resolved.

Why this answer

Successful ping to IP but failure to hostname indicates DNS resolution problem or incorrect DNS server configuration.

Full explanation →
344
MCQhard

Based on the exhibit, what is the most likely cause of the sshd service failure?

A.The firewall is blocking port 22
B.The sshd configuration file has incorrect permissions
C.The sshd service is not installed
D.Another process is already listening on port 22
AnswerD

Error message directly indicates address already in use.

Why this answer

The sshd service failed because another process is already listening on port 22, which prevents sshd from binding to that port. This is indicated by the error message in the exhibit (e.g., 'bind: Address already in use'), which is a common symptom when a conflicting service or a previously running instance of sshd occupies the port. The system cannot start a new instance of sshd until the port is freed.

Exam trap

The trap here is that candidates often assume a firewall or permission issue is the cause, but the specific 'Address already in use' error directly points to a port conflict, which is a distinct and common scenario on Linux systems.

How to eliminate wrong answers

Option A is wrong because the firewall blocking port 22 would cause connection timeouts or 'No route to host' errors, not a failure of the sshd service to start; the service would still bind successfully. Option B is wrong because incorrect permissions on the sshd configuration file (e.g., /etc/ssh/sshd_config) would typically cause a 'Bad permissions' error during startup, not a port binding failure. Option C is wrong because if sshd were not installed, the system would report 'Unit sshd.service not found' or 'command not found', not a port conflict error.

Full explanation →
345
MCQhard

Refer to the exhibit. The service fails to start with the error 'Failed to start My Service: Unit not found'. What is the most likely cause?

A.The User specified does not exist.
B.The service file is not in the correct directory.
C.The network target is not reached.
D.The ExecStart script is missing.
AnswerB

Unit files must be placed in /etc/systemd/system/ or /lib/systemd/system/ to be recognized.

Why this answer

The error 'Unit not found' indicates that systemd cannot locate the service unit file. Systemd service files must be placed in specific directories such as /etc/systemd/system/ or /usr/lib/systemd/system/. If the file is in the wrong directory, systemd will not recognize the unit, causing the 'Unit not found' error.

Option B correctly identifies this as the most likely cause.

Exam trap

CompTIA often tests the distinction between 'unit not found' (file location issue) and 'command not found' or 'exec format error' (missing executable or script), leading candidates to incorrectly choose the missing ExecStart script option.

How to eliminate wrong answers

Option A is wrong because a non-existent User would cause a different error, such as 'Failed to determine user credentials' or 'User 'xxx' not found', not 'Unit not found'. Option C is wrong because the network target not being reached would result in a dependency failure or timeout, not a 'Unit not found' error. Option D is wrong because a missing ExecStart script would produce an error like 'Exec format error' or 'No such file or directory' when the service attempts to start, not a failure to find the unit itself.

Full explanation →
346
MCQeasy

A server is experiencing high CPU load. The administrator needs to identify which process is consuming the most CPU resources in real time. Which command should be used?

A.w
B.vmstat
C.uptime
D.ps aux --sort=-%cpu
E.top
AnswerE

top provides real-time process CPU usage.

Why this answer

The `top` command provides a real-time, dynamic view of running processes, including CPU usage, and updates continuously by default. It is the standard tool for identifying which process is currently consuming the most CPU resources on a Linux system.

Exam trap

The trap here is that candidates often choose `ps aux --sort=-%cpu` because it shows CPU-sorted output, but they overlook the requirement for real-time monitoring, which `top` uniquely provides through continuous updates.

How to eliminate wrong answers

Option A is wrong because `w` displays who is logged in and what they are doing, along with system load averages, but it does not show per-process CPU usage. Option B is wrong because `vmstat` reports system-wide statistics for processes, memory, paging, block I/O, traps, and CPU activity, but it does not list individual processes sorted by CPU consumption. Option C is wrong because `uptime` only shows how long the system has been running, the number of users, and load averages, with no process-level detail.

Option D is wrong because `ps aux --sort=-%cpu` gives a snapshot of processes sorted by CPU usage, but it is not a real-time updating tool; it must be re-run manually to see changes.

Full explanation →
347
MCQmedium

A user reports that they cannot access a file because permission is denied. The file's permissions are -rwsr-xr-x. What special permission is set?

A.No special permission
B.SUID
C.Sticky bit
D.SGID
AnswerB

The s in the user execute position means SUID is set.

Why this answer

The 's' in the owner execute position indicates SUID (Set User ID) is set.

Full explanation →
348
MCQhard

An administrator needs to capture network traffic on interface eth0, filter for packets to/from host 10.0.0.1, and save the output to a file for later analysis. Which command should be used?

A.tcpdump -i eth0 src 10.0.0.1 -w capture.pcap
B.tcpdump -i eth0 dst 10.0.0.1 -w capture.pcap
C.tcpdump -i eth0 host 10.0.0.1 -w capture.pcap
D.tcpdump -i eth0 -n host 10.0.0.1 -w capture.pcap
AnswerC

Correct syntax: interface, host filter, and -w for output.

Why this answer

The `tcpdump` command with the `host` filter captures all traffic (both source and destination) to or from the specified IP address, which matches the requirement to filter for packets to/from host 10.0.0.1. The `-i eth0` specifies the interface, and `-w capture.pcap` writes the output to a file for later analysis.

Exam trap

The trap here is that candidates often confuse `src` and `dst` filters as sufficient for capturing all traffic to/from a host, forgetting that `host` is the correct primitive for bidirectional capture.

How to eliminate wrong answers

Option A is wrong because `src 10.0.0.1` only captures packets where the source IP is 10.0.0.1, missing packets destined to that host. Option B is wrong because `dst 10.0.0.1` only captures packets where the destination IP is 10.0.0.1, missing packets sourced from that host. Option D is wrong because the `-n` flag disables name resolution (which is not required by the question) but does not affect the filter; however, the primary issue is that it includes an unnecessary flag, and the question asks for the correct command, not an equivalent one with extra options.

Full explanation →
349
MCQmedium

An administrator needs to replace all occurrences of '192.168.1.1' with '10.0.0.1' in a configuration file named config.txt. Which sed command should be used to perform an in-place edit?

A.sed -i 's/192.168.1.1/10.0.0.1/g' config.txt
B.sed -i 's/192.168.1.1/10.0.0.1/' config.txt
C.sed -e 's/192.168.1.1/10.0.0.1/g' config.txt
D.sed 's/192.168.1.1/10.0.0.1/g' config.txt > config.txt
AnswerA

Correct in-place substitution.

Why this answer

sed -i 's/192.168.1.1/10.0.0.1/g' config.txt performs global replacement in-place.

Full explanation →
350
MCQhard

An Apache web server (httpd) is serving content from a custom directory /webapps/company. The root directory is labeled with the default_t context, causing httpd to be denied access. Which command should the administrator use to persistently relabel the directory for httpd access?

A.restorecon -v /webapps/company
B.chcon -t httpd_sys_content_t /webapps/company
C.setsebool -P httpd_read_user_content on
D.semanage fcontext -a -t httpd_sys_content_t '/webapps/company(/.*)?'
AnswerD

This sets the persistent default SELinux type for the directory and its contents.

Why this answer

`semanage fcontext` modifies the SELinux file context policy persistently, and the regex `/webapps/company(/.*)?` ensures the rule applies to the directory and all its contents. This is necessary because `restorecon` (option A) only applies the default context from the policy, which is `default_t` for this custom path, and `chcon` (option B) is non-persistent and will be overwritten by a file system relabel. The `setsebool` (option C) controls a boolean for user content, not the file context of a custom directory.

Exam trap

The trap here is that candidates confuse `chcon` (immediate but non-persistent) with `semanage fcontext` (persistent via policy), or they incorrectly assume `restorecon` can change the context to a non-default type when it only restores the type defined in the policy.

How to eliminate wrong answers

Option A is wrong because `restorecon -v /webapps/company` would reset the context to the default `default_t` type, which is the very context causing the denial, not the `httpd_sys_content_t` type needed for Apache access. Option B is wrong because `chcon -t httpd_sys_content_t /webapps/company` changes the context immediately but is not persistent; it will be reverted to the policy default after a file system relabel or `restorecon` run. Option C is wrong because `setsebool -P httpd_read_user_content on` enables a boolean that allows httpd to read user home directories (typically `/home/*/public_html`), not a custom directory like `/webapps/company`.

Full explanation →
351
MCQmedium

Which of the following commands will display the last 10 lines of a log file and also output new lines as they are appended?

A.head -f logfile
B.less +F logfile
C.tail -f logfile
D.cat logfile
AnswerC

Correct: -f follows the file.

Why this answer

The `tail -f logfile` command displays the last 10 lines of the file by default and then continues to monitor the file for new lines, outputting them as they are appended. The `-f` (follow) option keeps the file open and polls for changes, making it the standard tool for real-time log monitoring.

Exam trap

The trap here is that candidates may confuse `tail -f` with `less +F` (which also works but uses a different syntax) or mistakenly think `head` can follow a file, but the exam expects precise knowledge of the `tail -f` command as the standard for real-time log viewing.

How to eliminate wrong answers

Option A is wrong because `head -f` is not a valid command; `head` does not support a `-f` flag, and even if it did, `head` reads from the beginning of the file, not the end. Option B is wrong because `less +F` does not exist; the correct syntax to follow a file in `less` is `less +F` (uppercase F) which enters follow mode, but the lowercase `+F` is invalid and will cause an error. Option D is wrong because `cat logfile` simply outputs the entire file content to stdout and does not provide any real-time monitoring or line limiting.

Full explanation →
352
MCQhard

A system administrator runs 'umask 027' in a Bash shell. What will be the default permissions for a new directory created in that shell? (Assume no other umask changes.)

A.rwxrwxr-x (775)
B.rwxrwxrwx (777)
C.rw-rw-r-- (664)
D.rwxr-x--- (750)
AnswerD

Correct: 777 - 027 = 750.

Why this answer

The umask value 027 subtracts permissions from the base 777 for directories. 777 minus 027 equals 750, which translates to rwxr-x---. The owner gets full permissions (rwx), the group gets read and execute (r-x), and others get no permissions (---).

Exam trap

CompTIA often tests the distinction between file and directory base permissions (666 vs 777) and the fact that umask subtracts from the base, not from a fixed value like 755.

How to eliminate wrong answers

Option A is wrong because it represents permissions 775 (rwxrwxr-x), which would result from a umask of 002, not 027. Option B is wrong because it represents permissions 777 (rwxrwxrwx), which would result from a umask of 000, not 027. Option C is wrong because it represents permissions 664 (rw-rw-r--), which is the default for files (base 666) with a umask of 002, not for directories with umask 027.

Full explanation →
353
MCQeasy

A Linux administrator discovers that a user's home directory contains a file with setuid bit set, owned by root. The file is not part of any authorized software. What is the most appropriate immediate action?

A.Move the file to /tmp for further analysis
B.Delete the file immediately to remove the threat
C.Change the file owner to the user with 'chown user:user <file>'
D.Remove the setuid bit with 'chmod u-s <file>'
AnswerD

This removes the setuid bit, preventing privilege escalation, while preserving the file.

Why this answer

The immediate priority is to neutralize the unauthorized setuid root binary, which poses a privilege escalation risk. Removing the setuid bit with 'chmod u-s' disables the ability for any user to execute the file with root privileges, containing the threat without destroying evidence that may be needed for forensic analysis. This aligns with security best practices of preserving artifacts while mitigating active risks.

Exam trap

The trap here is that candidates often choose deletion (Option B) as the 'obvious' fix, overlooking the forensic value of the file and the fact that removing the setuid bit is a less destructive and equally effective containment measure.

How to eliminate wrong answers

Option A is wrong because moving the file to /tmp does not remove the setuid bit; the file would retain its setuid root capability in /tmp, still allowing privilege escalation. Option B is wrong because deleting the file immediately destroys potential forensic evidence (e.g., timestamps, contents, metadata) that could be critical for understanding the breach or attacker's methods. Option C is wrong because changing the owner to the user does not remove the setuid bit; the file would still execute with the new owner's privileges, which could be the user themselves, failing to eliminate the privilege escalation vector.

Full explanation →
354
MCQhard

An administrator notices that a process is running with the context 'unconfined_u:unconfined_r:unconfined_t:s0'. What does this indicate about SELinux?

A.The process is running in permissive mode.
B.The process is running in an unconfined domain.
C.SELinux is disabled.
D.The process is confined by a targeted policy.
AnswerB

Unconfined domains have minimal restrictions.

Why this answer

The 'unconfined' domain means the process is not restricted by SELinux policy; it can run as if SELinux is disabled.

Full explanation →
355
MCQeasy

In a Bash script, what is the difference between single quotes and double quotes?

A.Both behave the same.
B.Single quotes allow variable expansion; double quotes do not.
C.Double quotes prevent all substitutions; single quotes allow command substitution.
D.Single quotes prevent variable expansion; double quotes allow it.
AnswerD

Double quotes permit $VAR and $(command) expansions.

Why this answer

Single quotes preserve the literal value of each character, while double quotes allow variable expansion and command substitution.

Full explanation →
356
Multi-Selecthard

A DevOps engineer is creating a Dockerfile for a Node.js application. Which THREE of the following instructions are valid and commonly used in a Dockerfile? (Choose THREE.)

Select 3 answers
A.EXECUTE node app.js
B.COPY . /app
C.RUN npm install
D.INSTALL package.json
E.FROM node:14
AnswersB, C, E

COPY copies files from host to container.

Why this answer

Common Dockerfile instructions include FROM, RUN, COPY, EXPOSE, CMD, ENTRYPOINT, etc. The valid ones here are FROM, RUN, and COPY.

Full explanation →
357
MCQeasy

Which command displays the current SELinux mode?

A.selinuxenabled
B.sestatus
C.setenforce
D.getenforce
AnswerD

Correct command.

Why this answer

The `getenforce` command displays the current SELinux mode as either Enforcing, Permissive, or Disabled. It directly queries the SELinux status from the kernel and returns the current enforcement state without requiring elevated privileges. This makes it the correct command for simply viewing the current mode.

Exam trap

The trap here is that candidates confuse `setenforce` (which changes the mode) with `getenforce` (which displays the mode), or they assume `sestatus` is the only command to check SELinux state, overlooking the simpler `getenforce` command specifically asked for the current mode.

How to eliminate wrong answers

Option A is wrong because `selinuxenabled` only returns an exit code (0 if SELinux is enabled, 1 if disabled) and does not display the current mode. Option B is wrong because `sestatus` provides detailed SELinux status information including the mode, but it is not the command that specifically displays only the current mode; it shows additional context like policy version and loaded policy name. Option C is wrong because `setenforce` is used to change the SELinux mode (e.g., `setenforce 0` for permissive, `setenforce 1` for enforcing) and does not display the current mode.

Full explanation →
358
MCQeasy

An administrator wants to verify which RPM packages are installed on a Red Hat Enterprise Linux system. Which command displays that information?

A.dpkg -l
B.apt list --installed
C.rpm -qa
D.yum list installed
AnswerC

rpm -qa queries all installed RPM packages.

Why this answer

The `rpm -qa` command queries the RPM database and lists all installed packages on a Red Hat Enterprise Linux system. The `-q` flag enables query mode, and `-a` specifies all packages, making it the correct tool for this task.

Exam trap

The trap here is that candidates familiar with Debian-based systems might choose `dpkg -l` or `apt list --installed`, while those who use yum daily might pick `yum list installed` because it works, but the exam specifically tests knowledge of the native RPM command `rpm -qa` for direct package database queries.

How to eliminate wrong answers

Option A is wrong because `dpkg -l` is the Debian package manager command used on Debian-based systems (e.g., Ubuntu), not on Red Hat Enterprise Linux which uses RPM. Option B is wrong because `apt list --installed` is also a Debian/APT command for listing installed packages, not applicable to RHEL. Option D is wrong because `yum list installed` does display installed packages on RHEL, but the question asks for the command that displays RPM package information; while yum uses RPM under the hood, `rpm -qa` is the direct RPM command, and in the context of this exam, `yum list installed` is a higher-level tool that is not the direct RPM command being tested.

Full explanation →
359
MCQhard

A developer reports that a Docker container on a CentOS 7 host cannot connect to the internet. The host itself can access the internet. The container is started with default bridge network. The administrator checks iptables and sees the FORWARD policy is DROP. What is the most likely cause and solution?

A.The container needs to be run with --network host.
B.The container's DNS configuration is incorrect.
C.Add iptables rules to allow forwarding and enable masquerading.
D.AppArmor is blocking outbound connections.
AnswerC

Docker manages iptables, but if the FORWARD policy is DROP without proper rules, container traffic is blocked. Adding rules or restarting Docker restores connectivity.

Why this answer

The default Docker bridge network relies on iptables NAT (masquerading) and FORWARD rules to allow containers to reach external networks. When the FORWARD policy is set to DROP, the host drops all forwarded packets from the container, blocking outbound internet access. Adding iptables rules to allow forwarding (e.g., `-A FORWARD -i docker0 -j ACCEPT`) and enabling masquerading (e.g., `-t nat -A POSTROUTING -s 172.17.0.0/16 -o eth0 -j MASQUERADE`) restores connectivity.

Exam trap

The trap here is that candidates may assume DNS or network mode is the issue, but the explicit mention of the FORWARD policy being DROP directly points to a missing iptables forwarding rule, which is a classic Linux networking troubleshooting scenario.

How to eliminate wrong answers

Option A is wrong because `--network host` bypasses Docker's network isolation and uses the host's network stack directly, which is unnecessary and reduces security; the issue is specifically with the default bridge and iptables forwarding, not the network mode. Option B is wrong because DNS configuration affects name resolution, not raw IP connectivity; the container cannot reach any external IP, indicating a packet forwarding problem rather than a DNS issue. Option D is wrong because AppArmor is a Linux Security Module (LSM) that confines programs via profiles, but it does not manage network forwarding or iptables policies; CentOS 7 uses SELinux by default, not AppArmor, and the symptom points to iptables, not mandatory access control.

Full explanation →
360
Multi-Selecthard

An administrator wants to change the runlevel/target to a state where only a minimal set of processes is running, and network services are disabled. Which two systemd targets achieve this? (Choose two.)

Select 2 answers
A.graphical.target
B.rescue.target
C.poweroff.target
D.multi-user.target
E.emergency.target
AnswersB, E

Correct: rescue.target provides a minimal environment with network disabled.

Why this answer

(rescue.target) is correct because it boots the system into a single-user mode with a minimal set of processes and no network services, allowing administrative tasks like filesystem repairs. Option E (emergency.target) is correct because it starts an even more minimal environment with only a root shell on the console, also disabling network services. Both targets satisfy the requirement of minimal processes and disabled networking.

Exam trap

The trap here is that candidates often confuse rescue.target with multi-user.target, thinking that disabling networking means any non-graphical target, but multi-user.target still enables network services by default.

Full explanation →
361
MCQeasy

A Linux administrator needs to check which services are listening on TCP ports on a server. Which command should be used to replace the deprecated netstat command?

A.ss -tlnp
B.nmap localhost
C.ip link show
D.dig -t any localhost
AnswerA

The `ss -tlnp` command uses the `-t` flag to filter only TCP sockets, `-l` to show only listening sockets, `-n` to display numeric addresses and ports without DNS resolution, and `-p` to reveal the process identifier and name. This directly replaces `netstat -tlnp` by reading socket information from the kernel’s `/proc/net/tcp` and `/proc/net/tcp6` files, satisfying the stem’s requirement to check services listening on TCP ports.

Why this answer

The ss command is the modern replacement for netstat, and ss -tlnp shows listening TCP ports with process information.

Full explanation →
362
Multi-Selectmedium

Which TWO statements are true regarding the use of Ansible for automation? (Choose TWO.)

Select 2 answers
A.Ansible requires a dedicated master server to manage nodes.
B.Ansible playbooks are written in YAML.
C.Ansible is agentless and uses SSH for communication.
D.Ansible uses a pull-based model where nodes fetch configurations from a central server.
E.Ansible modules are written in Ruby.
AnswersB, C

Ansible playbooks are YAML files that define automation tasks.

Why this answer

Ansible playbooks are written in YAML (YAML Ain't Markup Language), which is a human-readable data serialization standard. YAML allows for simple, declarative syntax to define automation tasks, variables, and handlers, making playbooks easy to write and maintain without requiring programming expertise.

Exam trap

The trap here is that candidates often confuse Ansible's push-based model with pull-based tools like Puppet or Chef, or assume a master server is required because other automation tools use a master-agent architecture.

Full explanation →
363
MCQeasy

Based on the exhibit, what best describes the security implication?

A.The SUID bit is set, allowing users to run passwd with root privileges to change their own password.
B.The file is world-writable.
C.The SGID bit is set, allowing users to run passwd with group root.
D.The sticky bit is set, preventing deletion of the file.
AnswerA

The 's' in the user execute position indicates SUID.

Why this answer

The SUID (Set User ID) bit is set on the /usr/bin/passwd file, as indicated by the 's' in the owner's execute position (e.g., -rwsr-xr-x). This allows any user to run the passwd command with the effective UID of the file owner (root), enabling them to change their own password by writing to /etc/shadow, which is otherwise only writable by root. This is a standard security mechanism, not a vulnerability, as the passwd binary is carefully designed to only allow password changes for the invoking user.

Exam trap

CompTIA often tests the distinction between SUID, SGID, and sticky bits by presenting a file listing with an 's' in the owner's execute position and expecting candidates to recognize it as SUID, not confusing it with SGID (which would be in the group position) or the sticky bit (which would be a 't' in the others position).

How to eliminate wrong answers

Option B is wrong because the file permissions shown (e.g., -rwsr-xr-x) indicate the file is not world-writable; the 'w' bit for 'others' is not set. Option C is wrong because the SGID bit is not set; the group execute position shows 'x' (or 's' only if SGID were set), and the group is not 'root' but typically 'shadow' or 'root' depending on the system, but the key point is that the 's' is in the owner's position, not the group's. Option D is wrong because the sticky bit is not set; the sticky bit would appear as a 't' in the 'others' execute position, and it is not present in the given permissions.

Full explanation →
364
MCQmedium

A security policy requires that SSH root login be disabled, but key-based authentication for users should remain enabled. Which configuration line should be added to /etc/ssh/sshd_config?

A.PermitEmptyPasswords no
B.PermitRootLogin no
C.PasswordAuthentication yes
D.PermitRootLogin prohibit-password
AnswerD

This disables password authentication for root while allowing key-based login.

Why this answer

The directive `PermitRootLogin prohibit-password` in `/etc/ssh/sshd_config` disables password-based authentication for the root user while still allowing key-based authentication (e.g., SSH public key or GSSAPI). This satisfies the security policy requirement to disable root login via passwords but retain the ability for users (including root) to authenticate using SSH keys.

Exam trap

The trap here is that candidates often confuse `PermitRootLogin no` (which blocks all root SSH access) with `PermitRootLogin prohibit-password` (which only blocks password-based root access), leading them to choose option B when the question explicitly requires key-based authentication to remain enabled.

How to eliminate wrong answers

Option A is wrong because `PermitEmptyPasswords no` only prevents login with empty passwords; it does not disable root login or affect key-based authentication. Option B is wrong because `PermitRootLogin no` completely disables all SSH logins for root, including key-based authentication, which violates the requirement to keep key-based authentication enabled. Option C is wrong because `PasswordAuthentication yes` explicitly enables password authentication for all users, including root, which directly contradicts the policy to disable SSH root login.

Full explanation →
365
Drag & Dropmedium

Drag and drop the steps to configure a static IP address using the command line in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Static IP configuration involves editing the network config file and restarting the service to apply changes.

Full explanation →
366
MCQmedium

You are managing a containerized microservices environment using Podman. One of the services needs to access a PostgreSQL database running in a separate container. The database container is named 'db' and uses the default bridge network. The application container is launched with the command: podman run -d --name app --network host myapp. The application fails to connect to the database using the hostname 'db'. Which change should you resolve the issue?

A.Use a user-defined network and connect both containers
B.Use --link db:db when running app container
C.Set environment variable DB_HOST=localhost
D.Run app container on the same network as db using --network bridge
AnswerA

A user-defined network provides automatic DNS resolution, allowing 'db' to resolve to the database container.

Why this answer

The default bridge network in Podman does not provide automatic DNS resolution between containers by name. When the app container uses `--network host`, it shares the host's network stack and is not connected to any container network, so it cannot resolve the container name 'db'. A user-defined network enables built-in DNS resolution, allowing containers to communicate by name.

Connecting both containers to the same user-defined network resolves the connectivity issue.

Exam trap

CompTIA often tests the misconception that the default bridge network supports automatic DNS resolution by container name, when in reality only user-defined networks provide that feature in both Podman and Docker.

How to eliminate wrong answers

Option B is wrong because `--link` is a legacy Docker feature not supported in Podman; Podman uses DNS-based service discovery on user-defined networks instead. Option C is wrong because setting `DB_HOST=localhost` would point to the host's loopback interface, but the database container is not listening on the host's loopback unless port mapping is explicitly configured, which is not the case here. Option D is wrong because `--network bridge` is the default network mode, but the app container is already using `--network host`, which overrides any other network setting; even if both containers were on the default bridge, they would not be able to resolve each other by name without a user-defined network.

Full explanation →
367
MCQmedium

A system administrator is hardening SSH and needs to disable root login and password authentication. Which two directives should be set in /etc/ssh/sshd_config?

A.PermitRootLogin no and ChallengeResponseAuthentication no
B.DenyUsers root and PasswordAuthentication no
C.PermitRootLogin no and PasswordAuthentication no
D.PermitRootLogin prohibit-password and PasswordAuthentication yes
AnswerC

These two settings disable root login and password auth.

Why this answer

Disabling root login and password authentication are two separate directives in sshd_config. PermitRootLogin no prevents direct SSH access for the root user, and PasswordAuthentication no disables password-based logins, forcing the use of key-based authentication. Both directives are required to meet the hardening goal.

Exam trap

The trap here is that candidates confuse ChallengeResponseAuthentication with PasswordAuthentication, or assume DenyUsers is a valid directive for blocking root, when the correct syntax is PermitRootLogin no.

How to eliminate wrong answers

Option A is wrong because ChallengeResponseAuthentication no disables challenge-response authentication (e.g., keyboard-interactive), but it does not disable password authentication; PasswordAuthentication must be explicitly set to no. Option B is wrong because DenyUsers root is not a valid sshd_config directive; the correct directive is PermitRootLogin no. Option D is wrong because PasswordAuthentication yes enables password authentication, which contradicts the requirement to disable it; PermitRootLogin prohibit-password allows root login with key-based authentication but does not disable password authentication for other users.

Full explanation →
368
MCQmedium

An administrator wants to generate a self-signed certificate and private key for testing. Which command creates both in one step?

A.openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes
B.openssl genrsa -out key.pem 2048
C.openssl req -new -x509 -days 365 -key key.pem -out cert.pem
D.openssl x509 -req -in req.pem -signkey key.pem -out cert.pem
AnswerA

Generates key and certificate in one command.

Why this answer

The `openssl req -x509 -newkey rsa:2048` command generates a new private key (via `-newkey`) and immediately creates a self-signed X.509 certificate (via `-x509`) in a single step. The `-keyout` and `-out` flags specify the output files for the private key and certificate, respectively, and `-nodes` ensures the private key is not encrypted with a passphrase, which is typical for testing scenarios.

Exam trap

The trap here is that candidates often confuse `openssl req -new` (which creates a CSR) with `openssl req -x509` (which creates a self-signed certificate), leading them to pick option C, which requires a pre-existing key and does not generate both in one step.

How to eliminate wrong answers

Option B is wrong because `openssl genrsa` only creates an RSA private key; it does not generate a certificate, so it fails to produce both artifacts in one step. Option C is wrong because it uses `-key key.pem` to reference an existing private key file, meaning the private key must already exist; it does not create a new private key as part of the command. Option D is wrong because `openssl x509 -req` processes a Certificate Signing Request (CSR) and signs it with a provided key; it requires a pre-existing CSR and private key, so it does not generate both in one step.

Full explanation →
369
MCQmedium

A system administrator needs to add an iptables rule to drop incoming TCP traffic on port 22 (SSH) from the IP address 10.0.0.100. Which command should be used?

A.iptables -A INPUT -p udp --dport 22 -s 10.0.0.100 -j DROP
B.iptables -I OUTPUT -p tcp --sport 22 -d 10.0.0.100 -j DROP
C.iptables -A FORWARD -p tcp --dport 22 -s 10.0.0.100 -j DROP
D.iptables -A INPUT -p tcp --dport 22 -s 10.0.0.100 -j DROP
AnswerD

This appends a rule to the INPUT chain to drop SSH from that source.

Why this answer

The correct syntax is iptables -A INPUT -p tcp --dport 22 -s 10.0.0.100 -j DROP. The chain is INPUT, protocol tcp, destination port 22, source IP, and target DROP.

Full explanation →
370
Multi-Selecthard

Which TWO conditions must be met for a user to successfully delete a file owned by a different user in a directory? (Choose two.)

Select 2 answers
A.The user has write permission on the file
B.The user has write permission on the directory
C.The user has execute permission on the directory
D.The user is the owner of the file
E.The user is a member of the group that owns the directory
AnswersB, C

Write permission on the directory is required to delete entries.

Why this answer

To delete a file in Linux, the user does not need any permissions on the file itself; instead, the user needs write permission on the directory because deleting a file modifies the directory's contents (removing the directory entry). Additionally, execute permission on the directory is required to access the directory and its inode entries, allowing the user to traverse the directory to locate the file. These two permissions together enable the deletion of a file owned by another user.

Exam trap

The trap here is that candidates mistakenly think file write permission (Option A) or file ownership (Option D) is required for deletion, when in fact directory permissions are the sole deciding factor for removing a directory entry.

Full explanation →
371
Multi-Selectmedium

A Linux administrator is hardening a server. Which TWO actions are effective in preventing unauthorized access via SSH? (Select TWO.)

Select 2 answers
A.Set PermitRootLogin yes
B.Set PasswordAuthentication yes
C.Disable the SSH service
D.Set PermitRootLogin no in /etc/ssh/sshd_config
E.Set PasswordAuthentication no and use SSH keys
AnswersD, E

Prevents direct root login.

Why this answer

Setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents direct root login via SSH, forcing administrators to log in as a regular user and then use `su` or `sudo` for privilege escalation. This reduces the attack surface by eliminating the ability to brute-force the root password directly over SSH.

Exam trap

The trap here is that candidates may think disabling the SSH service (Option C) is a valid hardening step, but the question asks for actions that prevent unauthorized access *via SSH* while still allowing legitimate remote administration.

Full explanation →
372
Multi-Selecthard

A system administrator is investigating a performance issue and wants to view kernel-related messages. Which three commands can be used to access kernel ring buffer messages? (Choose three.)

Select 3 answers
A.tail -f /var/log/syslog
B.dmesg
C.cat /var/log/kern.log
D.journalctl -k
E.systemctl status
AnswersB, C, D

Directly prints kernel ring buffer.

Why this answer

dmesg displays kernel ring buffer. journalctl -k shows kernel messages from systemd journal. cat /var/log/kern.log if available, but /var/log/messages often contains kernel messages; however, the question expects common commands.

Full explanation →
373
MCQmedium

A Docker container needs to persistently store data that should survive container removal and be accessible by other containers. Which storage method should be used?

A.Volume
B.Bind mount
C.Container layer
D.tmpfs mount
AnswerA

Correct. Volumes are the preferred mechanism for persistent and sharable data.

Why this answer

Volumes are managed by Docker and persist independently of containers. Bind mounts depend on host filesystem structure. tmpfs is temporary and stored in memory. The question asks for persistent storage that can be shared, so volumes are best.

Full explanation →
374
Multi-Selecteasy

A security administrator needs to verify the SELinux context of files in a directory. Which TWO commands can be used? (Choose two.)

Select 2 answers
A.getenforce
B.ps -Z
C.ls -Z
D.stat -Z
E.chcon
AnswersC, D

Lists files with their SELinux security context.

Why this answer

The `ls -Z` command displays the SELinux security context of files in a directory, showing the user, role, type, and sensitivity level. The `stat -Z` command also retrieves the SELinux context along with other file metadata, making both commands valid for verifying SELinux contexts.

Exam trap

The trap here is that candidates confuse `ls -Z` and `ps -Z` because both use the `-Z` flag, but `ps -Z` applies to processes, not files, leading to an incorrect selection.

Full explanation →
375
MCQhard

An administrator needs to trace system calls made by a process that is misbehaving. Which command should be used to attach to the running process and display its system calls?

A.tcpdump -i any
B.ltrace -p <PID>
C.strace -p <PID>
D.lsof -p <PID>
AnswerC

strace -p attaches to a process and shows system calls.

Why this answer

strace can attach to a running process with -p PID and display all system calls made by the process.

Full explanation →
Page 4

Page 5 of 14

Page 6

All pages

1234567891011121314

Practice XK0-006 by domain

Target a specific domain to shore up weak areas.

Services and User ManagementSecurityTroubleshootingAutomation, Orchestration, and ScriptingSystem Management
See all domains with question counts →