Courseiva

CompTIA Linux+ (XK0-006) (XK0-006) — Questions 376–450

979 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 5

Page 6 of 14

Page 7
376
Multi-Selecthard

A Linux administrator needs to implement a cron job that runs a script every day at 2:30 PM. Which TWO cron schedule expressions are equivalent?

Select 2 answers
A.30 14 * * *
B.30 2 * * * PM
C.30 2 * * *
D.30 2 * * *
E.30 14 * * *
AnswersA, E

2:30 PM.

Why this answer

In cron syntax, the first field is minute (0-59), the second is hour (0-23) in 24-hour format. 2:30 PM corresponds to hour 14 in 24-hour time. Therefore, '30 14 * * *' correctly specifies the job runs at minute 30 of hour 14 every day. Option A and E are identical and both use the correct 24-hour representation.

Exam trap

CompTIA often tests the 24-hour vs 12-hour clock confusion in cron expressions, where candidates mistakenly use '2' for 2 PM instead of converting to '14'.

Full explanation →
377
Matchingmedium

Match each Linux process signal to its typical action.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Hangup, often reload config

Interrupt from keyboard (Ctrl+C)

Force kill (cannot be caught)

Terminate gracefully

Stop/pause process (cannot be caught)

Why these pairings

Common Linux signals include SIGTERM (graceful termination), SIGKILL (force kill), and SIGINT (interrupt via Ctrl+C). Confusions often arise between SIGTERM and SIGKILL, and between SIGINT and SIGKILL.

Full explanation →
378
MCQhard

During the boot process, after the kernel is loaded and the initramfs is executed, which component is responsible for starting the user-space services and managing the system state?

A.initramfs
B.systemd
C.GRUB2
D.Kernel
AnswerB

Correct: systemd is the init system that starts services and manages targets.

Why this answer

Systemd is the init system that starts services and manages targets. GRUB2 is the bootloader that loads the kernel. The kernel itself initializes hardware.

Initramfs is an initial root filesystem used to load drivers.

Full explanation →
379
MCQmedium

A sysadmin wants to run a containerized web application using Podman. The container needs to persist data across restarts. Which approach ensures data persistence?

A.Run the container with --restart always.
B.Mount a host directory as a volume using -v.
C.Include the data using COPY in the Dockerfile.
D.Use docker commit to save changes.
AnswerB

Mounting a volume allows data to be stored on the host, surviving container restarts and removal.

Why this answer

Mounting a host directory as a volume using the `-v` flag (e.g., `podman run -v /host/path:/container/path ...`) ensures that data written inside the container is stored on the host filesystem. This data persists independently of the container's lifecycle, surviving container restarts, stops, or even removal. Podman, like Docker, treats volumes as external storage that outlives the container.

Exam trap

The trap here is that candidates confuse container restart policies (like `--restart always`) with data persistence, assuming that keeping the container running automatically preserves its data, when in fact the container's writable layer is ephemeral and lost on removal.

How to eliminate wrong answers

Option A is wrong because `--restart always` only controls the container's restart policy (e.g., after a crash or reboot), but it does not preserve data when the container is removed or its filesystem is replaced; any data written inside the container's writable layer is lost upon container deletion. Option C is wrong because the `COPY` instruction in a Dockerfile bakes data into the container image at build time, making it read-only and immutable; it cannot persist runtime data across restarts or container updates. Option D is wrong because `docker commit` creates a new image from a container's current state, which is a manual, snapshot-based approach that does not provide ongoing persistence; it also requires explicit action and bloats image layers, and is not a standard method for persistent storage in production.

Full explanation →
380
MCQhard

A company runs a critical web application on a Linux server. The server has 16GB RAM and 4 CPU cores. Recently, users have reported intermittent timeouts and slow response times. The administrator logs in and runs 'top', which shows the web server process using 200% CPU (multi-threaded) and 2GB RAM. Free memory is 12GB, and swap usage is 0. The load average is 3.5, 4.0, 4.2. The administrator checks 'dmesg' and sees no OOM or hardware errors. The web server logs show many 'connection refused' errors during peak times. The application is configured to handle up to 500 concurrent connections. The administrator suspects the issue is related to the number of worker processes or threads. Which of the following is the BEST course of action to resolve the issue?

A.Increase the number of worker processes or threads in the web server configuration.
B.Add more CPU cores by migrating to a larger instance.
C.Decrease the number of worker processes to reduce CPU load.
D.Add more RAM to the server.
AnswerA

This directly addresses the connection refused errors by allowing more concurrent connections.

Why this answer

The web server is using 200% CPU (multi-threaded) and has 12GB free RAM with no swap usage, indicating CPU is the bottleneck, not memory. The load average (3.5–4.2) exceeds the 4 CPU cores, meaning the system is overloaded with processes/threads. The 'connection refused' errors during peak times suggest the server is hitting its connection limit (500 concurrent connections) and rejecting new ones.

Increasing worker processes/threads allows the server to handle more concurrent connections, utilizing the available CPU cores more efficiently to reduce timeouts and refusals.

Exam trap

CompTIA often tests the misconception that high CPU usage always means the server needs fewer workers or more hardware, but the real issue here is that the server is rejecting connections because it has too few workers to handle the configured 500 concurrent connections, not because the CPU is overloaded by existing workers.

How to eliminate wrong answers

Option B is wrong because adding more CPU cores does not address the root cause—the web server is already CPU-bound with 200% usage, but the issue is insufficient worker processes to handle peak connections, not a lack of cores; migrating to a larger instance is an expensive and unnecessary overprovisioning. Option C is wrong because decreasing worker processes would reduce the number of concurrent connections the server can handle, worsening the 'connection refused' errors and increasing timeouts. Option D is wrong because 12GB of free RAM and 0 swap usage indicate memory is not a constraint; adding RAM does not resolve the CPU-bound connection handling limit.

Full explanation →
381
MCQmedium

An administrator wants to run a script every Monday at 3:00 PM using a systemd timer. Which unit file configuration is correct for the timer?

A.OnCalendar=Mon *-*-* 15:00:00
B.OnCalendar=weekly Monday 15:00
C.ExecStart=/usr/local/bin/script.sh
D.OnCalendar=daily 15:00
AnswerA

Correct syntax for Monday at 3 PM.

Why this answer

Systemd timer units use the `OnCalendar=` directive with a calendar event format that follows `DayOfWeek Year-Month-Day Hour:Minute:Second`. The pattern `Mon *-*-* 15:00:00` specifies every Monday at 15:00:00, where the asterisks act as wildcards for any year, month, and day. This matches the requirement to run a script every Monday at 3:00 PM.

Exam trap

CompTIA often tests the distinction between timer unit directives and service unit directives, and the trap here is that candidates mistakenly think `ExecStart=` belongs in the timer file or confuse the `OnCalendar=` syntax with cron-style or human-readable formats like 'weekly Monday 15:00'.

How to eliminate wrong answers

Option B is wrong because `OnCalendar=weekly Monday 15:00` is not a valid systemd calendar event format; systemd does not accept the keyword 'weekly' combined with a day name and time in that syntax, and the correct format requires a full timestamp with wildcards. Option C is wrong because `ExecStart=` is a directive for service units, not timer units; timer units use `OnCalendar=` or other time-based triggers, and `ExecStart=` would be placed in the corresponding service unit file. Option D is wrong because `OnCalendar=daily 15:00` would run the script every day at 15:00, not specifically on Mondays, failing the requirement for a weekly Monday-only schedule.

Full explanation →
382
MCQhard

An administrator notices that an AppArmor profile is in complain mode for a service that should be enforcing. Which command changes the profile to enforce mode?

A.apparmor_parser -r /etc/apparmor.d/profile
B.aa-status --enforce /etc/apparmor.d/profile
C.aa-enforce /etc/apparmor.d/profile
D.aa-complain /etc/apparmor.d/profile
AnswerC

Enforces the specified profile.

Why this answer

aa-enforce sets a profile to enforce mode. aa-complain sets to complain, aa-status shows status, and apparmor_parser loads profiles.

Full explanation →
383
MCQhard

An administrator is troubleshooting an AppArmor profile that is blocking a custom application. They want to set the profile to complain mode to gather violations without enforcing. Which command should they use?

A.aa-status
B.aa-complain /path/to/profile
C.apparmor_parser -r /etc/apparmor.d/profile
D.aa-enforce /path/to/profile
AnswerB

Sets complain mode.

Why this answer

aa-complain sets the profile to complain mode.

Full explanation →
384
MCQmedium

An administrator writes a bash script that uses a function to check if a file exists and is readable. The function returns 0 if the file meets the conditions, and 1 otherwise. Which of the following correctly implements this function?

A.check_file() { [[ -f "$1" ]] && [[ -r "$1" ]] && return 0; return 1; }
B.check_file() { test -f "$1" && test -r "$1" && return 0 || return 1; }
C.check_file() { if [ -f "$1" -a -r "$1" ]; then return 0; else return 1; fi; }
D.check_file() { if [[ -f "$1" && -r "$1" ]]; then return 0; else return 1; fi; }
AnswerA, B, C, D

Incorrect. This function uses separate test commands chained with &&, but the final 'return 1' is not part of an else clause. While it may work in practice, it is less readable and can be confusing. The correct approach is to use an if-else structure or a single compound condition.

Why this answer

All four options are functionally correct. Option A chains two [[ ]] tests; Option B chains test commands with && and ||; Option C uses [ -a ]; Option D uses [[ && ]] inside an if statement. Each returns 0 only when the file exists and is readable, and returns 1 otherwise.

If a single-answer question is required, the stem should be revised.

Full explanation →
385
Multi-Selectmedium

A security audit has identified that several users have excessive sudo privileges. The administrator needs to review and modify sudo access. Which two files or commands would be used? (Choose TWO.)

Select 2 answers
A.chage
B.visudo
C.usermod -G
D./etc/sudoers
E./etc/group
AnswersB, D

Command to safely edit /etc/sudoers.

Why this answer

visudo is the recommended way to edit /etc/sudoers safely. The file /etc/sudoers contains the rules. /etc/sudoers.d/ is a directory for drop-in files. The other options are unrelated.

Full explanation →
386
MCQeasy

An administrator wants to check the amount of free memory and swap usage on a system in a human-readable format. Which command should be used?

A.free -h
B.vmstat -h
C.cat /proc/meminfo
D.iostat -h
AnswerA

free -h shows memory in human-readable format.

Why this answer

free -h displays memory and swap usage in human-readable units (e.g., GiB).

Full explanation →
387
Multi-Selecthard

A Linux administrator needs to configure a service to start automatically after a network connection is established. The service should only run when the network is up, and should stop when the network goes down. Which two systemd unit options should be used? (Choose two.)

Select 2 answers
A.Requires=network.target
B.PartOf=network.service
C.BindsTo=network.target
D.Wants=network.target
E.After=network.target
AnswersC, E

BindsTo ties service lifecycle to network; if network stops, service stops.

Why this answer

(BindsTo=network.target) is correct because it creates a stronger dependency than Requires: if the network target stops, systemd will stop the service as well, ensuring the service only runs when the network is up. Option E (After=network.target) is correct because it orders the service to start only after the network target has been reached, preventing the service from attempting to start before the network is available.

Exam trap

The trap here is that candidates often confuse BindsTo= with Requires=, thinking both ensure the service stops when the network fails, but only BindsTo= enforces automatic stopping, while Requires= only ensures startup ordering without lifecycle coupling.

Full explanation →
388
MCQmedium

A system is experiencing high CPU usage due to a background process with PID 2345. The administrator wants to reduce the process's priority by 5 without stopping it. Which command should be used?

A.kill -STOP 2345
B.renice -n -5 -p 2345
C.kill -9 2345
D.renice -n +5 -p 2345
AnswerD

Adds 5 to the nice value, lowering the priority.

Why this answer

The correct command is `renice -n +5 -p 2345` because `renice` adjusts the scheduling priority of a running process. A positive niceness value (+5) lowers the priority (makes the process 'nicer' to others), which reduces CPU usage. The `-n` flag specifies the adjustment value, and `-p` identifies the process by PID.

This matches the requirement to reduce priority by 5 without stopping the process.

Exam trap

The trap here is confusing the sign of the nice value: candidates often think a negative number reduces priority, but in Linux, a higher nice value (positive adjustment) actually lowers priority, while a negative adjustment increases it.

How to eliminate wrong answers

Option A is wrong because `kill -STOP 2345` suspends the process (sends SIGSTOP), which stops it from running entirely, rather than reducing its priority. Option B is wrong because `renice -n -5 -p 2345` increases the process's priority (makes it less 'nice'), which would worsen high CPU usage, not reduce it. Option C is wrong because `kill -9 2345` sends SIGKILL, which terminates the process immediately, violating the requirement to not stop it.

Full explanation →
389
MCQmedium

An administrator runs the commands shown in the exhibit. The container is accessible via curl using the container IP. However, the administrator cannot access the web server using the host's IP address on port 80. What is the most likely cause?

A.The container's IP address is incorrect.
B.The container's port 80 is not published to the host.
C.Nginx is configured to listen on a different port.
D.The container is not running.
AnswerB

No -p option was used; port is only accessible on the container's network.

Why this answer

The administrator ran `docker run -d nginx` without the `-p` or `--publish` flag, which means port 80 inside the container is not mapped to any port on the host. The container is accessible via its own IP because Docker networking allows direct container-to-container communication, but the host's IP on port 80 remains unbound, so curl to the host IP fails. Publishing the port with `-p 80:80` would expose the container's port 80 on the host's interface.

Exam trap

The trap here is that candidates assume a running container with a working service is automatically accessible on the host's IP, but Docker requires explicit port publishing to bridge the host network namespace to the container's network namespace.

How to eliminate wrong answers

Option A is wrong because the container's IP address is correct—the administrator can curl the container IP successfully, proving the container is reachable at that address. Option C is wrong because Nginx inside the official nginx container listens on port 80 by default, and the successful curl to the container IP confirms the web server is responding on that port. Option D is wrong because the container is running (the `docker ps` output would show it, and curl to the container IP works), so the issue is not a stopped container.

Full explanation →
390
MCQhard

An administrator needs to set a password expiration policy so that all users must change their password every 90 days. Which command and option accomplishes this for an existing user?

A.usermod -e 90 <username>
B.passwd -x 90 <username>
C.chage -W 90 <username>
D.chage -M 90 <username>
AnswerD

This sets the maximum password age to 90 days; the user must change the password after that period.

Why this answer

The `chage -M 90 <username>` command sets the maximum number of days a password is valid for an existing user. The `-M` option specifies the maximum password age in days, so after 90 days the user will be forced to change their password. This directly implements the required 90-day password expiration policy.

Exam trap

The trap here is that candidates confuse the `-M` (maximum days) option with the `-W` (warning days) option, or incorrectly assume `passwd` or `usermod` can set password aging, when in fact `chage` is the dedicated utility for this purpose.

How to eliminate wrong answers

Option A is wrong because `usermod -e` sets an account expiration date (in YYYY-MM-DD format), not a password aging policy; using `-e 90` would be invalid as it expects a date, not a number of days. Option B is wrong because `passwd -x 90` sets the maximum password age, but the `passwd` command is used to change a user's own password or by root to set password attributes; however, the `-x` option is not a standard option for `passwd` on most Linux distributions (the correct command for password aging is `chage`, not `passwd`). Option C is wrong because `chage -W 90` sets the number of days before password expiration that the user receives a warning, not the maximum password age; this would warn the user 90 days before expiration, which is not the same as setting a 90-day expiration period.

Full explanation →
391
Multi-Selectmedium

An administrator needs to identify which processes are consuming the most CPU and memory resources. Which two commands can provide this information? (Choose two.)

Select 2 answers
A.top
B.free -h
C.iostat -x
D.vmstat 1 5
E.ps aux --sort=-%mem
AnswersA, E

top provides real-time per-process CPU and memory usage.

Why this answer

The `top` command provides a real-time, dynamic view of running processes, displaying CPU and memory usage by default and allowing sorting by resource consumption. The `ps aux --sort=-%mem` command lists all processes with detailed memory and CPU statistics, sorted by memory usage in descending order, making it easy to identify the most resource-intensive processes.

Exam trap

The key distinction is between system-wide monitoring commands (like `free`, `vmstat`, `iostat`) and per-process commands (like `top`, `ps`). Candidates mistakenly choose `free -h` or `vmstat` thinking they show per-process CPU/memory details.

Full explanation →
392
MCQmedium

An administrator needs to find all files in /var/log that have been modified within the last 2 days. Which find command should be used?

A.find /var/log -mtime -2
B.find /var/log -mtime +2
C.find /var/log -atime -2
D.find /var/log -ctime 2
AnswerA

Correct: -mtime -2 finds files modified in last 2 days.

Why this answer

-mtime -2 means modified less than 2 days ago (i.e., within the last 48 hours).

Full explanation →
393
MCQhard

Refer to the exhibit. An administrator attempts to mount all filesystems and receives an error. What is the most likely cause?

A.The /var entry has a wrong filesystem type.
B.The UUID for /var is incorrect in fstab.
C.The /var directory has been deleted or is missing.
D.The /var filesystem is corrupted.
AnswerC

The error 'mount point does not exist' and 'No such file or directory' for /var indicate the directory is missing.

Full explanation →
394
MCQmedium

A team uses Ansible for configuration management. They want to ensure a service is running on all managed nodes. Which Ansible module should be used in the playbook?

A.systemd
B.service
C.command
D.shell
AnswerB

Correct. The service module ensures a service is in the desired state.

Why this answer

The service module manages services (start, stop, restart, etc.). The other modules are for different purposes.

Full explanation →
395
MCQmedium

To harden SSH, an administrator needs to disable root login over SSH. Which directive should be set in /etc/ssh/sshd_config?

A.RootLogin no
B.PermitRootLogin no
C.DenyUsers root
D.AllowUsers root
AnswerB

Correct directive to disable root login.

Why this answer

PermitRootLogin no prevents root from logging in via SSH.

Full explanation →
396
MCQmedium

A Linux administrator is writing a bash script that needs to iterate over all files ending with .log in /var/log and output the number of lines in each file. Which loop construct should be used?

A.while read f; do wc -l "$f"; done < /var/log/*.log
B.for f in /var/log/*.log; do wc -l "$f"; done
C.for ((i=0; i<${#files[@]}; i++)); do wc -l "${files[$i]}"; done
D.until [ -z "$f" ]; do wc -l "$f"; shift; done
AnswerB

Correct. The for loop iterates over each file matching the glob.

Why this answer

A for loop with a glob pattern is the simplest way to iterate over files matching a pattern.

Full explanation →
397
MCQmedium

A user named 'jdoe' needs to run commands as root without being given the root password. The administrator wants to grant jdoe the ability to run any command as root, but only after entering their own password. Which entry in /etc/sudoers accomplishes this?

A.jdoe ALL=(ALL) NOPASSWD: ALL
B.jdoe ALL=(root) /usr/bin/su
C.jdoe ALL= /bin/su -
D.jdoe ALL=(ALL) ALL
AnswerD

This allows jdoe to run any command as any user, but requires a password by default.

Why this answer

The format is 'user host=(runas) commands'. The correct entry grants jdoe full root access with password authentication.

Full explanation →
398
MCQmedium

After a system update, a custom application no longer runs due to a shared library error. The library exists on the system but is in a non-standard path. Which environment variable should be checked or set to resolve this?

A.LD_PRELOAD
B.PATH
C.LD_LIBRARY_PATH
D.LD_RUN_PATH
AnswerC

This environment variable tells the dynamic linker where to find libraries.

Why this answer

The LD_LIBRARY_PATH environment variable tells the dynamic linker (ld.so) where to search for shared libraries before the standard system paths. When a custom application fails with a shared library error after an update, and the library exists in a non-standard path, setting LD_LIBRARY_PATH to include that path resolves the issue by allowing the linker to find the library at runtime.

Exam trap

CompTIA often tests the distinction between LD_LIBRARY_PATH (runtime library search path) and LD_RUN_PATH (link-time RPATH embedding), causing candidates to confuse the two when the question explicitly mentions a runtime error after an update.

How to eliminate wrong answers

Option A is wrong because LD_PRELOAD is used to force the loading of a specific shared library before all others, typically for overriding functions or debugging, not for adding a search path for missing libraries. Option B is wrong because PATH controls the search path for executable binaries, not for shared libraries; it is used by the shell to find commands, not by the dynamic linker. Option D is wrong because LD_RUN_PATH is used at link time (when building the application) to embed a library search path into the binary's RPATH, not at runtime to resolve a missing library after the system update.

Full explanation →
399
MCQeasy

A system administrator is tasked with ensuring that users cannot delete files owned by other users in a shared directory. Which permission should be set on the directory?

A.Apply an ACL
B.Set the sticky bit
C.Set the SGID bit
D.Set the SUID bit
AnswerB

The sticky bit prevents users from deleting files they do not own in the directory.

Why this answer

The sticky bit (chmod +t) on a directory restricts deletion so that only the file owner, the directory owner, or root can remove files, even if the directory has world-writable permissions. This directly prevents users from deleting files owned by others in a shared directory, which is the requirement.

Exam trap

The trap here is that candidates often confuse the sticky bit with SUID or SGID, or think an ACL is required, but the sticky bit is the exact POSIX mechanism designed for shared directory deletion control.

How to eliminate wrong answers

Option A is wrong because an ACL (Access Control List) provides fine-grained permissions for specific users or groups but does not inherently restrict deletion to file owners; it can be configured to do so, but the standard, simplest solution is the sticky bit, not an ACL. Option C is wrong because the SGID bit (setgid) on a directory causes new files to inherit the directory's group, not restrict deletion; it addresses group ownership inheritance, not deletion prevention. Option D is wrong because the SUID bit (setuid) on a directory is ignored on most Unix/Linux systems (it has no effect on directories) and is used on executables to run with the owner's privileges, not to control file deletion.

Full explanation →
400
MCQeasy

Which directory in the FHS contains essential user command binaries that are needed in single-user mode?

A./usr/bin
B./sbin
C./opt/bin
D./bin
AnswerD

Correct: /bin contains essential user binaries.

Why this answer

The /bin directory, as defined by the Filesystem Hierarchy Standard (FHS), contains essential user command binaries (e.g., ls, cp, mv) that are required for booting, repairing, and operating the system in single-user mode. Single-user mode mounts only the root filesystem, so /bin must be on the root partition to provide these critical utilities without relying on other filesystems like /usr.

Exam trap

The trap here is that candidates confuse /sbin with /bin, assuming all essential binaries are in /sbin, but /sbin is specifically for system administration tools, while /bin holds the user command binaries required in single-user mode.

How to eliminate wrong answers

Option A is wrong because /usr/bin contains non-essential user binaries that are not guaranteed to be available in single-user mode, as /usr may be a separate filesystem that is not mounted during early boot or recovery. Option B is wrong because /sbin contains system administration binaries (e.g., fdisk, init) intended for system maintenance, not general user commands, and is separate from the user command binaries specified in the question. Option C is wrong because /opt/bin is not a standard FHS directory; /opt is reserved for add-on application software packages, and its binaries are not part of the essential system binaries needed in single-user mode.

Full explanation →
401
Multi-Selectmedium

A Linux engineer needs to ensure a bash script runs with strict error handling. Which TWO of the following should be included? (Choose two.)

Select 2 answers
A.set -o pipefail
B.set -n
C.set -e
D.set -x
E.shopt -s histappend
AnswersA, C

Exit on pipeline failure.

Why this answer

'set -o pipefail', is correct because it ensures that if any command in a pipeline fails (returns a non-zero exit status), the entire pipeline's exit status reflects that failure. Without it, only the last command's exit status is considered, which can mask errors in earlier pipeline stages. Option C, 'set -e', is correct because it causes the script to exit immediately upon any command returning a non-zero exit status, preventing silent failures from propagating.

Exam trap

CompTIA often tests the distinction between debugging options (set -x) and error-handling options (set -e, set -o pipefail), leading candidates to mistakenly choose set -x as a strict error-handling mechanism.

Full explanation →
402
Multi-Selecthard

A DevOps engineer is building a Docker image for a web application. They want to ensure the image is as small as possible and that sensitive data is not left in layers. Which two practices help achieve these goals? (Choose TWO.)

Select 2 answers
A.Using the ADD instruction instead of COPY.
B.Using multi-stage builds to separate build and runtime environments.
C.Combining multiple RUN commands into one using &&.
D.Using the latest tag for base images.
E.Installing all packages in a single layer.
AnswersB, C

Keeps final image clean.

Why this answer

Combining RUN commands reduces layers, and using multi-stage builds avoids including build tools in the final image.

Full explanation →
403
MCQmedium

In a bash script, a developer needs to parse command-line options such as -f filename and -v (verbose). Which built-in command is best suited for this task?

A.getopt
B.getopts
C.case
D.shift
AnswerB

Correct. getopts is the built-in command for parsing options.

Why this answer

getopts is a bash built-in for parsing command-line options. It handles short options and requires option arguments.

Full explanation →
404
Multi-Selectmedium

Which TWO commands effectively disable a systemd service to prevent it from starting, either automatically or manually? (Select 2.)

Select 2 answers
A.systemctl disable
B.systemctl stop
C.systemctl reset-failed
D.systemctl kill
E.systemctl mask
AnswersA, E

Disable removes the symlink that enables the service at boot, preventing automatic start.

Why this answer

`systemctl disable` removes the symlinks that cause the service to start automatically at boot, preventing automatic starts. `systemctl mask` creates a strong symlink to `/dev/null`, which makes the service impossible to start either automatically or manually, as any attempt to start it is silently redirected to nothing.

Exam trap

The trap here is that candidates often confuse 'stopping' a service (temporary) with 'disabling' or 'masking' it (persistent prevention), and they may not realize that `mask` is the only command that blocks both automatic and manual starts.

Full explanation →
405
MCQhard

An administrator is configuring a server to act as a router and needs to enable IP forwarding persistently across reboots. Which file should be modified?

A./etc/network/interfaces
B./etc/sysctl.conf
C./etc/rc.local
D./proc/sys/net/ipv4/ip_forward
AnswerB

Adding net.ipv4.ip_forward=1 here makes it persistent.

Why this answer

/etc/sysctl.conf is the system-wide configuration file for kernel parameters managed by sysctl. Setting net.ipv4.ip_forward = 1 in this file ensures IP forwarding is enabled persistently across reboots, as sysctl applies these settings during boot.

Exam trap

The trap here is that candidates confuse the runtime procfs file (/proc/sys/net/ipv4/ip_forward) with a persistent configuration file, leading them to choose D, which only changes the value temporarily until the next reboot.

How to eliminate wrong answers

Option A is wrong because /etc/network/interfaces is used by ifupdown to configure network interfaces (e.g., IP addresses, gateways), not to set kernel-level IP forwarding. Option C is wrong because /etc/rc.local is a legacy script for custom startup commands, but it is not the standard or recommended method for persistent kernel parameter changes; it may also not execute if the service is disabled. Option D is wrong because /proc/sys/net/ipv4/ip_forward is a runtime virtual file that changes the parameter immediately but does not persist across reboots; modifications are lost after a restart.

Full explanation →
406
Multi-Selecthard

A security audit reveals that a service is running with an incorrect SELinux context. Which two commands can be used to relabel the file or directory to the correct context? (Choose TWO.)

Select 2 answers
A.setenforce 0
B.restorecon -R /path/to/file
C.chcon -t httpd_sys_content_t /path/to/file
D.fixfiles relabel
E.ls -Z
AnswersB, C

Restores default SELinux context.

Why this answer

restorecon restores default context based on policy, and chcon can set a specific context manually.

Full explanation →
407
Multi-Selecteasy

A system administrator needs to identify which processes are consuming the most memory on a Linux server. Which two commands can be used? (Select TWO).

Select 2 answers
A.vmstat
B.ps -aux
C.free -m
D.top
E.df -h
AnswersB, D

Can be sorted by memory usage using --sort=-%mem.

Why this answer

The `ps -aux` command displays all running processes with detailed information, including memory usage (%MEM and RSS). The `top` command provides a real-time, interactive view of processes sorted by memory consumption by default. Both commands directly show per-process memory usage, making them suitable for identifying the most memory-intensive processes.

Exam trap

The trap here is that candidates confuse system-wide memory reporting commands (like `free` or `vmstat`) with per-process memory analysis tools, leading them to select options that show total memory usage rather than identifying which specific processes are consuming it.

Full explanation →
408
MCQeasy

An administrator wants to view the kernel ring buffer messages to check for hardware errors. Which command should be used?

A.journalctl -k
B.dmesg
C.iostat
D.vmstat
AnswerB

dmesg prints kernel ring buffer messages.

Why this answer

dmesg displays kernel ring buffer messages, often used for hardware diagnostics.

Full explanation →
409
MCQeasy

A junior administrator needs to view the logs of a running container named 'webapp'. Which command should be used?

A.docker attach webapp
B.docker logs webapp
C.docker inspect webapp
D.docker stats webapp
AnswerB

Shows logs.

Why this answer

The `docker logs webapp` command retrieves the stdout and stderr output streams from the container's main process, which is the standard way to view logs for a running or stopped container. This is the correct approach because Docker captures these streams and stores them in a JSON file on the host, accessible via the `docker logs` command.

Exam trap

CompTIA often tests the distinction between `docker attach` (interactive session) and `docker logs` (passive log retrieval), trapping candidates who confuse attaching to a container's console with viewing its log history.

How to eliminate wrong answers

Option A is wrong because `docker attach` connects the terminal to the container's main process's stdin/stdout/stderr, which is used for interactive debugging and can block the terminal, not for viewing historical logs. Option C is wrong because `docker inspect` returns detailed metadata about the container (e.g., configuration, network settings, mounts) in JSON format, not the log output. Option D is wrong because `docker stats` displays live resource usage metrics (CPU, memory, network I/O) for running containers, not log content.

Full explanation →
410
MCQeasy

A user cannot start the Apache web service. The command 'systemctl start httpd' returns 'Failed to start httpd.service: Unit not found.' What is the most likely cause?

A.Network configuration is incorrect
B.Incorrect file permissions on /etc/httpd/
C.The httpd package is not installed
D.Disk space is full
AnswerC

Unit not found typically means the service is not installed.

Why this answer

The error 'Failed to start httpd.service: Unit not found' indicates that systemd cannot locate a service unit file for httpd. This most commonly occurs when the httpd package (Apache HTTP Server) is not installed on the system. Without the package, no service unit file exists under /usr/lib/systemd/system/, so systemctl cannot start the service.

Exam trap

The trap here is that candidates may confuse a missing package with a service that is installed but not enabled or has configuration issues, leading them to select options like incorrect permissions or network configuration instead of recognizing the fundamental absence of the service unit.

How to eliminate wrong answers

Option A is wrong because an incorrect network configuration would not cause systemd to report 'Unit not found'; it would typically result in a different error such as a timeout or failure to bind to an address. Option B is wrong because incorrect file permissions on /etc/httpd/ would not prevent systemd from finding the service unit; the unit file is located in /usr/lib/systemd/system/, not in /etc/httpd/. Option D is wrong because a full disk would produce a different error, such as 'No space left on device' or a failure to write logs, not a 'Unit not found' message from systemd.

Full explanation →
411
MCQhard

Refer to the exhibit. A user cannot access a web server, but another host on the same subnet can. What is the most likely cause?

A.The network router is blocking the user's traffic.
B.The web server is down.
C.DNS is resolving to the wrong IP for the user.
D.The user's workstation has a local firewall blocking outbound HTTPS.
AnswerD

The iptables output shows no rules, but the user's workstation gets 'Connection refused' while another host succeeds, indicating the issue is local to the workstation. A local firewall (e.g., software firewall) might be blocking outbound 443.

Full explanation →
412
MCQhard

Based on the exhibit, the service has failed. Which of the following is the most appropriate first step to diagnose the cause of the failure?

A.Check if the service is a timer and was triggered
B.Check the script /usr/local/bin/myservice.sh for errors and run it manually
C.Run systemctl daemon-reload to reload unit files
D.Restart the service using systemctl restart myservice.service
E.Run journalctl -u myservice.service to view logs
AnswerB

Directly diagnose the script's failure.

Why this answer

The exhibit indicates the service has failed, and the most appropriate first step is to check the script referenced in the unit file for errors and run it manually. This directly tests the executable that systemd is trying to run, isolating whether the failure is due to a script bug, missing dependencies, or permission issues, rather than assuming the service configuration or logs are the problem.

Exam trap

The trap here is that candidates often jump to checking logs (journalctl) or restarting the service, but the most efficient first step is to test the underlying script directly, as logs may not capture the exact error if the script fails before producing output.

How to eliminate wrong answers

Option A is wrong because checking if the service is a timer and was triggered is irrelevant unless the unit is a timer type, and the exhibit does not indicate that; it misdirects focus from the actual executable. Option C is wrong because running systemctl daemon-reload reloads unit files but does not diagnose why a running service failed; it is only needed after modifying unit files. Option D is wrong because restarting the service without diagnosing the root cause may mask the underlying issue and could lead to repeated failures.

Option E is wrong because while journalctl -u myservice.service can show logs, it is a secondary step; the most direct first step is to test the script manually to see if it runs correctly outside of systemd.

Full explanation →
413
MCQhard

A sysadmin runs the command and sees the exhibit output. What is the most likely cause of the db pod's status?

A.The container is out of memory.
B.The node running the pod is unreachable.
C.The pod does not have enough CPU resources.
D.The application inside the container is repeatedly crashing.
AnswerD

CrashLoopBackOff means the container exits with an error and is being restarted repeatedly.

Why this answer

The pod's status shows a high restart count (e.g., 5+ restarts) in the output of `kubectl get pods`, which is the classic indicator of a CrashLoopBackOff state. This occurs when the container's entrypoint process exits repeatedly, causing the container to crash and be restarted by the kubelet, until the back-off delay increases. The most likely cause is that the application inside the container is repeatedly crashing, not a resource or node issue.

Exam trap

The trap here is that candidates often confuse a high restart count with a resource exhaustion issue (OOM or CPU), but the key differentiator is the specific exit code and status message shown in `kubectl describe pod` or `kubectl logs`.

How to eliminate wrong answers

Option A is wrong because an out-of-memory (OOM) condition would typically show an OOMKilled status or an Exit Code 137, not a high restart count with CrashLoopBackOff. Option B is wrong because if the node were unreachable, the pod would show a NodeLost or Unknown status, not a running pod with restarts. Option C is wrong because insufficient CPU resources would result in a ContainerCreating or Pending state due to unschedulable pod, not a running pod that repeatedly crashes.

Full explanation →
414
MCQmedium

A company runs a web application on a Linux server (Ubuntu 22.04). The application writes log files to /var/log/app/access.log and error.log. Over time, these logs have grown to several gigabytes, causing the /var partition to reach 98% capacity. The administrator decides to implement log rotation using logrotate. They create a configuration file at /etc/logrotate.d/app with the following content: /var/log/app/*.log { weekly rotate 7 compress delaycompress size 100M missingok } They then run `logrotate -d /etc/logrotate.d/app` for debugging, which indicates no errors. However, after several days, the logs are not being rotated. Which step should the administrator take to resolve this?

A.Ensure that the logrotate cron job is enabled and that the configuration file is readable (644) and owned by root.
B.Change the ownership of /var/log/app to appuser:appgroup.
C.Run `logrotate -f /etc/logrotate.d/app` to force rotation immediately.
D.Add a cron job to run logrotate hourly.
AnswerA

The cron job may be disabled or the config file may have wrong permissions; these are common pitfalls.

Why this answer

The most likely cause is that the logrotate cron job (typically /etc/cron.daily/logrotate) is not enabled or not running, or the configuration file has incorrect permissions. The administrator should verify that the cron job is active and that the config file is readable (644) and owned by root so that the cron process can execute it daily. Option B (changing ownership of /var/log/app) is unnecessary because logrotate runs as root and can read any file.

Option C (forcing rotation with -f) only rotates logs once and does not fix the underlying scheduling issue. Option D (adding an hourly cron job) is excessive; logrotate is designed to run daily, and hourly rotation would be inappropriate for weekly rotation with size constraints.

Full explanation →
415
MCQmedium

A cron job scheduled by the root user is not executing. Which file is the most likely location for the root user's personal cron table?

A./var/spool/cron/root
B./var/spool/cron/crontabs
C./etc/crontab
D./etc/cron.d
AnswerA

User crontabs are stored in /var/spool/cron/.

Why this answer

On Linux systems, each user's personal crontab file is stored in /var/spool/cron/ (or /var/spool/cron/crontabs/ on some distributions). For the root user, this file is typically named 'root' (i.e., /var/spool/cron/root). When the root user runs 'crontab -e', the cron daemon reads from this file to execute scheduled tasks.

If this file is missing or misconfigured, the root user's cron jobs will not run.

Exam trap

The trap here is that candidates often confuse the system-wide crontab (/etc/crontab) or the cron.d directory with per-user crontab files, not realizing that each user's personal crontab is stored in /var/spool/cron/ with the username as the filename.

How to eliminate wrong answers

Option B is wrong because /var/spool/cron/crontabs is a directory (used on some systems like Debian/Ubuntu to hold per-user crontab files), not the root user's personal crontab file itself. Option C is wrong because /etc/crontab is the system-wide crontab file that requires a user field in each job line and is not the root user's personal crontab. Option D is wrong because /etc/cron.d is a directory for system-wide cron job snippets, not for an individual user's personal crontab.

Full explanation →
416
MCQeasy

A user reports that they cannot access a website by domain name but can access it by IP address. Which of the following is the most likely cause?

A.DNS resolution problem
B.Web server is down
C.Firewall blocking port 80
D.Incorrect default gateway
AnswerA

Domain name cannot be resolved to IP.

Why this answer

The user can access the website by IP address but not by domain name, which directly indicates that the system is unable to resolve the domain name to its corresponding IP address. This is a classic symptom of a DNS resolution problem, where the DNS client cannot query a DNS server or the DNS server fails to return the correct A or AAAA record. The fact that the web server is reachable by IP confirms that network connectivity and the web service itself are functioning correctly.

Exam trap

This question tests the distinction between connectivity issues and name resolution issues. The trap is that candidates may confuse a DNS failure with a web server or firewall problem, even though the ability to reach the server by IP clearly rules out those causes.

How to eliminate wrong answers

Option B is wrong because if the web server were down, the website would be inaccessible by both domain name and IP address, not just by domain name. Option C is wrong because a firewall blocking port 80 would prevent HTTP traffic regardless of whether the destination is specified by domain name or IP address, so both methods would fail. Option D is wrong because an incorrect default gateway would prevent all traffic destined for external networks, including both domain name resolution and direct IP access, so the user would not be able to access the site by IP address either.

Full explanation →
417
MCQeasy

A Linux server is configured to use Pluggable Authentication Modules (PAM). Which file is used to define the authentication order for the 'sshd' service?

A./etc/authselect/sshd
B./etc/security/sshd
C./etc/pam.d/sshd
D./etc/pam.d/login
AnswerC

This is the correct PAM configuration file for the SSH daemon.

Why this answer

In Linux, PAM configuration files for individual services are stored in /etc/pam.d/, with the filename matching the service name. For the sshd service, the file /etc/pam.d/sshd defines the authentication order, including the modules and their control flags (e.g., required, sufficient) that PAM will consult during SSH login. This is the standard location per the Linux PAM architecture, as documented in the pam.conf man page.

Exam trap

CompTIA often tests the distinction between /etc/pam.d/sshd and /etc/pam.d/login, as candidates may confuse the SSH service file with the general login file, especially since both handle authentication but for different services.

How to eliminate wrong answers

Option A is wrong because /etc/authselect/sshd is not a standard PAM file; authselect is a tool for managing system authentication profiles, but it does not directly define per-service PAM stacks. Option B is wrong because /etc/security/sshd is not a PAM configuration file; the /etc/security/ directory typically contains files like limits.conf or access.conf, not per-service PAM definitions. Option D is wrong because /etc/pam.d/login is the PAM configuration for the login service (used for console or terminal logins), not for the SSH daemon (sshd).

Full explanation →
418
MCQmedium

Refer to the exhibit. The system administrator runs the command 'auditctl -l' and sees the above rules. What is the purpose of these audit rules?

A.To log any changes (write or attribute) to the password, shadow, and group files
B.To log all successful login attempts on the system
C.To log any modifications to the audit configuration itself
D.To log all read accesses to /etc/passwd, /etc/shadow, and /etc/group
AnswerA

The -p wa flag is for write and attribute changes.

Why this answer

The audit rules use the `-w` flag to watch the files `/etc/passwd`, `/etc/shadow`, and `/etc/group` for `wa` (write and attribute change) syscalls. This logs any modification to these critical authentication and authorization files, such as user additions, password changes, or permission changes, which is essential for security monitoring.

Exam trap

The trap here is that candidates confuse the `-p wa` permission (write and attribute) with read access, assuming that watching these files logs all access, when in fact only modifications are recorded.

How to eliminate wrong answers

Option B is wrong because the rules watch for write and attribute changes, not login events; successful logins are typically audited via `-a exit,always -S execve` or `-w /var/log/wtmp -p wa` rules, not by watching these specific files. Option C is wrong because modifications to the audit configuration itself are logged by rules that watch `/etc/audit/audit.rules` or `/etc/audit/rules.d/`, not the password, shadow, and group files. Option D is wrong because the `-p wa` permission only captures write and attribute change operations, not read accesses; to log reads, the permission would need to be `-p r` or `-p rw`.

Full explanation →
419
MCQeasy

A Linux administrator needs to prevent the root user from logging in via SSH. Which directive should be set in /etc/ssh/sshd_config to accomplish this?

A.PasswordAuthentication no
B.PermitRootLogin no
C.MaxAuthTries 1
D.AllowUsers root
AnswerB

This setting prevents root from logging in via SSH.

Why this answer

The directive `PermitRootLogin no` in `/etc/ssh/sshd_config` explicitly disallows the root user from authenticating via SSH, regardless of the authentication method used. This is the standard way to block root SSH logins while still allowing other users to connect.

Exam trap

The trap here is that candidates often confuse `PasswordAuthentication no` with blocking root login, not realizing that root could still authenticate via SSH keys or other mechanisms if `PermitRootLogin` is not explicitly set to `no`.

How to eliminate wrong answers

Option A is wrong because `PasswordAuthentication no` disables password-based authentication for all users, but root could still log in using a public key or other methods; it does not specifically prevent root login. Option C is wrong because `MaxAuthTries 1` limits the number of authentication attempts per connection, but it does not prevent root from logging in on the first successful attempt. Option D is wrong because `AllowUsers root` explicitly permits only the root user to log in, which is the opposite of what is needed.

Full explanation →
420
MCQmedium

An administrator needs to check the current routing table on a Linux system. Which command should be used?

A.dig -t A
B.ss -r
C.ip neigh
D.ip route
AnswerD

ip route shows the routing table.

Why this answer

The `ip route` command displays the kernel routing table, showing the paths that packets take to reach network destinations. This is the standard tool on modern Linux systems for viewing and manipulating routing entries, replacing the older `route -n` command.

Exam trap

The trap here is that candidates confuse `ip neigh` (which shows ARP entries) with `ip route` (which shows the routing table), as both involve network path information but serve entirely different layers of the network stack.

How to eliminate wrong answers

Option A is wrong because `dig -t A` is a DNS lookup tool that queries for A records, not a routing table viewer. Option B is wrong because `ss -r` is not a valid flag combination; `ss` is used for socket statistics, and the `-r` flag does not exist (the correct flag for resolving hostnames is `-r` in `route`, not `ss`). Option C is wrong because `ip neigh` displays the neighbor table (ARP cache), which maps IP addresses to MAC addresses on the local link, not the routing table.

Full explanation →
421
MCQeasy

A technician is troubleshooting a network connectivity issue. They need to trace the path packets take to a remote server and see the round-trip time for each hop. Which command should they use?

A.ping
B.nslookup
C.traceroute
D.nmap
AnswerC

Traceroute shows each hop and its RTT.

Why this answer

traceroute (or tracepath) shows the path and RTT per hop.

Full explanation →
422
MCQhard

Refer to the exhibit. A systemd service is failing to start and is in a restart loop. What is the most likely cause?

A.The service attempts to bind to a port that is already in use by another process.
B.The application is crashing due to a missing configuration file.
C.The service is using too much memory and is being killed by the OOM killer.
D.The service executable is not found on the system.
AnswerA

Correct. The 'bind: address already in use' error directly points to a port conflict.

Why this answer

The log shows 'bind: address already in use', indicating that the port required by the service is already occupied by another process. This causes the service to exit immediately, and systemd repeatedly restarts it, resulting in a restart loop. Therefore, Option A is correct.

Option B is incorrect because there is no indication of a missing config file; the error is explicitly about port binding. Option C is incorrect because an OOM kill would produce an 'Out of memory' message in the kernel log, not a bind error. Option D is incorrect because a missing executable would cause a different error, such as 'Executable not found' in the service status.

Full explanation →
423
MCQhard

A server is unable to resolve hostnames via DNS. The /etc/resolv.conf file appears correct. Which command can be used to test DNS resolution and display the full query path?

A.nslookup example.com
B.host example.com
C.resolvectl query example.com
D.dig +trace example.com
AnswerD

Correct: Traces the full DNS resolution path.

Why this answer

The `dig +trace example.com` command performs a full iterative DNS resolution from the root nameservers down to the authoritative nameservers for the queried domain, displaying each step of the query path. This is the correct choice because the question specifically asks to 'display the full query path,' which `+trace` provides by following referrals step by step, unlike simpler queries that only show the final answer.

Exam trap

The trap here is that candidates often confuse simple DNS lookup tools (like `nslookup` or `host`) with the `dig +trace` option, assuming any DNS query tool can show the full resolution path, but only `dig +trace` explicitly performs and displays each iterative step.

How to eliminate wrong answers

Option A is wrong because `nslookup example.com` performs a recursive query to the configured DNS resolver and only returns the final answer (or an error), not the full query path. Option B is wrong because `host example.com` similarly performs a simple forward lookup and does not trace the iterative resolution steps. Option C is wrong because `resolvectl query example.com` is a systemd-resolved command that queries the local resolver cache or stub resolver, not performing a full trace of the DNS hierarchy.

Full explanation →
424
MCQhard

An administrator is investigating a Bash script that is failing unexpectedly. They want to see each command as it is executed to debug the script. Which command should be added to the script?

A.set -v
B.set -x
C.set -e
D.set -o xtrace
AnswerB

set -x prints commands and their arguments during execution.

Why this answer

set -x enables a trace of commands and their arguments as they are executed.

Full explanation →
425
MCQmedium

A security audit reveals that the /var/log directory has permissions 777. The administrator needs to ensure that only root can write to log files, while still allowing users to read system log files. Which command should the administrator run?

A.chmod 644 /var/log
B.chmod 755 /var/log
C.chmod 700 /var/log
D.chmod 750 /var/log
AnswerB

755 gives owner rwx, group and others rx, allowing read and execute but not write.

Why this answer

Chmod 755 sets the /var/log directory to rwxr-xr-x, meaning root (owner) has full write access, while group and others have read and execute permissions. This allows users to read log files (via execute to traverse the directory) but prevents them from writing, satisfying the audit requirement.

Exam trap

The trap here is that candidates often apply file permission logic to directories, forgetting that directories require the execute bit for access, leading them to choose 644 (which breaks directory traversal) instead of 755.

How to eliminate wrong answers

Option A is wrong because chmod 644 sets permissions to rw-r--r--, which removes the execute bit from the directory, preventing users from listing or accessing files within /var/log (directories require execute to traverse). Option C is wrong because chmod 700 sets permissions to rwx------, which restricts all access to only root, blocking users from reading system log files. Option D is wrong because chmod 750 sets permissions to rwxr-x---, which denies read access to 'others' (non-group users), preventing them from reading log files as required.

Full explanation →
426
MCQhard

A financial services company runs a critical trading application on a Linux server. The application logs to /var/log/trade/app.log. Recently, the application has been crashing intermittently. The administrator suspects disk space issues. Upon checking, /var/log/trade is on a separate partition with 200 GB capacity, and df -h shows only 10% used. However, the administrator notices that log rotation is not working; the log file has grown to 50 GB and is still being written to. The administrator needs to immediately free up space without stopping the application, and also ensure proper log rotation is configured. Which command sequence should the administrator use?

A.Run 'mv /var/log/trade/app.log /tmp' to move the file, then create a new empty log file, and check with 'df -h'.
B.Run 'logrotate -f /etc/logrotate.conf' to force rotation, then verify with 'df -h'.
C.Run 'systemctl stop trade && rm /var/log/trade/app.log && systemctl start trade' to stop the application, delete the log, and restart.
D.Run '> /var/log/trade/app.log' to truncate the log file, then check with 'df -h'.
AnswerB

Forces log rotation without stopping the application, freeing space.

Why this answer

'logrotate -f' forces an immediate log rotation without stopping the application, which frees disk space by compressing or removing the old log file and creating a new empty one. The administrator can then verify the freed space with 'df -h'. This approach solves both the immediate space issue and ensures proper rotation is configured for the future.

Exam trap

CompTIA often tests the misconception that deleting or moving a log file while an application holds an open file handle will immediately free disk space, when in fact the space is only released after the file handle is closed.

How to eliminate wrong answers

Option A is wrong because moving the log file while the application is still writing to it will cause the application to continue writing to the moved file (since the file handle remains open), and the new empty file will not receive logs until the application is restarted or the file handle is released; this does not free space immediately. Option C is wrong because stopping the application to delete the log file violates the requirement to not stop the application, and deleting the file while the application holds an open handle will not free the disk space until the handle is closed (the space remains allocated). Option D is wrong because truncating the file with '> /var/log/trade/app.log' only empties the file content but does not release the disk space immediately on some filesystems (e.g., ext4 with delayed allocation) and may cause the application to lose its write position or crash if it does not handle the truncation gracefully.

Full explanation →
427
MCQmedium

In a Bash script, the following array is defined: fruits=('apple' 'banana' 'cherry'). Which syntax correctly iterates over all elements of the array?

A.for fruit in "${fruits[*]}"; do echo $fruit; done
B.for fruit in "${fruits[@]}"; do echo $fruit; done
C.for fruit in ${fruits[@]}; do echo $fruit; done
D.for fruit in ${fruits}; do echo $fruit; done
AnswerB

Correct. Iterates over each element as separate items.

Why this answer

To iterate over all elements of an array, use for fruit in "${fruits[@]}"; do ... done. The [@] syntax expands to all elements.

Full explanation →
428
MCQhard

A Linux server is booting but stops at a prompt with the message 'Give root password for maintenance'. Which systemd target is the system likely trying to reach?

A.emergency.target
B.graphical.target
C.multi-user.target
D.rescue.target
AnswerA

Correct: emergency.target provides a minimal environment with a root shell for maintenance.

Why this answer

emergency.target gives a single-user root shell with minimal services. rescue.target also gives a shell but with more services loaded. The prompt 'Give root password for maintenance' is typical of emergency mode.

Full explanation →
429
MCQmedium

A web server running on port 8080 must be accessible from external networks. The system uses firewalld. Which command opens port 8080/tcp permanently in the default zone?

A.firewall-cmd --zone=public --add-service=8080/tcp --permanent
B.firewall-cmd --permanent --add-port=8080/tcp
C.iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
D.firewall-cmd --add-port=8080/tcp
AnswerB

Correct: --permanent makes it persistent, --add-port opens the port.

Why this answer

The correct firewalld command is 'firewall-cmd --permanent --add-port=8080/tcp' followed by '--reload'.

Full explanation →
430
MCQhard

A Linux server in a DMZ is experiencing intermittent SSH lockouts. The /var/log/secure shows repeated failed login attempts from multiple IP addresses, but then suddenly the administrator cannot SSH in even with correct credentials. The administrator suspects a brute-force protection mechanism. The server uses PAM with pam_tally2 for login counting. The administrator checks /etc/pam.d/sshd and sees: auth required pam_tally2.so deny=3 unlock_time=300 onerr=succeed file=/var/log/tallylog. What is the most likely reason the administrator is locked out even after 5 minutes?

A.The SSH server is not configured with UsePAM yes, so pam_tally2 is not applied
B.The tallylog file has incorrect permissions, preventing pam_tally2 from reading the count
C.The root account is not subject to pam_tally2 without the 'even_deny_root' option, so the lockout is from another mechanism
D.The DenyHosts service is running and blocks IPs after too many failures
AnswerC

Correct. pam_tally2 does not apply to the root account unless the 'even_deny_root' option is added. Since the administrator is likely logging in as root, the lockout is from another source like sshd's MaxAuthTries or fail2ban.

Why this answer

Pam_tally2 does not apply to the root account unless the 'even_deny_root' option is explicitly added to the pam_tally2 configuration line. Since the administrator is likely logging in as root (or the root account is being targeted), the lockout observed is not from pam_tally2 but from another mechanism such as sshd's own MaxAuthTries or a separate service like fail2ban. The configuration shown only denies regular users after 3 failures and unlocks after 300 seconds, but root remains unaffected by this rule.

Exam trap

The trap here is that candidates assume pam_tally2 applies equally to all users, including root, without realizing the default exemption for root and the need for the 'even_deny_root' option.

How to eliminate wrong answers

Option A is wrong because the question states the server uses PAM with pam_tally2, and the administrator is checking /etc/pam.d/sshd, which implies UsePAM yes is already set; otherwise, the pam_tally2 line would have no effect at all, and the lockout behavior would not be observed. Option B is wrong because incorrect permissions on /var/log/tallylog would cause pam_tally2 to fail (potentially with onerr=succeed allowing access), not cause a lockout; the lockout is still happening, so the file is readable. Option D is wrong because while DenyHosts could cause IP-based lockouts, the question specifically states the administrator suspects a brute-force protection mechanism and checks pam_tally2; the most likely reason given the pam_tally2 configuration is the root account exemption, not an unrelated service.

Full explanation →
431
MCQhard

A system administrator is troubleshooting a network issue on a Linux server running CentOS 7. The server is unable to connect to the internet, but internal network connections work fine. The administrator checks the network configuration: the server has a static IP 192.168.1.100/24, default gateway 192.168.1.1, and DNS server 8.8.8.8. The administrator can ping the gateway but cannot ping 8.8.8.8. From the server, a traceroute to 8.8.8.8 stops at the gateway. The administrator also notices that the route table shows a default route via 192.168.1.1. What is the most likely cause?

A.The router is not performing NAT correctly
B.The DNS server is not responding
C.The default gateway is not reachable
D.The subnet mask is incorrectly configured
AnswerA

The traceroute stopping at the gateway suggests the router is not forwarding packets to the internet, likely due to NAT misconfiguration.

Why this answer

The server can ping the gateway (192.168.1.1) but cannot reach 8.8.8.8, and traceroute stops at the gateway. This indicates that the server’s default route is correctly configured and the gateway is reachable, but the router is not forwarding traffic beyond the local subnet. Since internal connections work, the most likely cause is that the router is not performing Network Address Translation (NAT) correctly, which is required to translate private IP addresses (192.168.x.x) to a public IP for internet access.

Exam trap

The trap here is that candidates may think a reachable gateway and a default route guarantee internet connectivity, but they overlook the necessity of NAT for private-to-public IP translation in a typical SOHO or enterprise network.

How to eliminate wrong answers

Option B is wrong because the DNS server (8.8.8.8) is being tested via ICMP ping, not DNS resolution; a non-responding DNS server would not prevent a ping to that IP. Option C is wrong because the administrator can successfully ping the default gateway (192.168.1.1), confirming it is reachable. Option D is wrong because the subnet mask /24 is correct for the 192.168.1.0/24 network, and internal connections work, so there is no subnet mismatch.

Full explanation →
432
MCQmedium

A user cannot access a website, but other websites work. The administrator wants to see the HTTP response headers from the web server. Which command is most appropriate?

A.wget --spider https://example.com
B.curl -I https://example.com
C.curl -v https://example.com
D.telnet example.com 80
AnswerB

Correct: -I fetches only headers.

Why this answer

curl -I fetches the HTTP headers only, which is useful for debugging web server responses.

Full explanation →
433
MCQhard

A system administrator wants to ensure a service starts automatically at boot and also starts immediately without rebooting. Which of the following systemctl commands or command combinations achieve both goals? (Choose all that apply.)

A.systemctl enable service && systemctl restart service
B.systemctl start --now service
C.systemctl start service && systemctl enable service
D.systemctl enable --now service
AnswerC, D

Correct: This two-command sequence starts the service immediately and configures it to start at boot.

Why this answer

Both options C and D are correct. Option C uses two commands: 'systemctl start service' to start immediately and 'systemctl enable service' to enable boot-time start. Option D uses a single command 'systemctl enable --now service' which simultaneously enables the service for boot and starts it immediately.

Options A and B are incorrect because A enables but doesn't start immediately (unless restart is used, which assumes already running), and B starts immediately but doesn't enable for boot.

Full explanation →
434
Multi-Selecthard

A Linux administrator needs to identify which of the following filesystems are journaling filesystems commonly used in Linux. (Choose three.)

Select 3 answers
A.swap
B.ext4
C.FAT32
D.btrfs
E.xfs
AnswersB, D, E

ext4 is a journaling filesystem.

Why this answer

ext4, xfs, and btrfs are journaling filesystems. FAT32 is not journaling. swap is a swap space, not a filesystem.

Full explanation →
435
MCQeasy

Which command will create a compressed tar archive of a directory?

A.tar -czf archive.tar.gz dir
B.tar -xzf archive.tar.gz
C.tar -cf archive.tar dir
D.tar -tf archive.tar
AnswerA

This creates a gzip compressed tar archive.

Why this answer

The `-czf` flags combine `-c` (create archive), `-z` (compress with gzip), and `-f` (specify archive file name). This creates a compressed tar archive of the specified directory, outputting a `.tar.gz` file. The command `tar -czf archive.tar.gz dir` is the standard syntax for this operation.

Exam trap

CompTIA often tests the distinction between create (`-c`), extract (`-x`), and list (`-t`) flags, and the requirement of `-z` for gzip compression, causing candidates to confuse `-czf` with `-xzf` or omit `-z` entirely.

How to eliminate wrong answers

Option B is wrong because `-xzf` extracts (decompresses) an existing archive, not creates one; the `-x` flag stands for extract. Option C is wrong because `-cf` creates an uncompressed tar archive (`.tar` only), missing the `-z` flag for gzip compression. Option D is wrong because `-tf` lists the contents of an existing archive without creating or compressing anything.

Full explanation →
436
Multi-Selectmedium

A security analyst wants to identify all lines in a log file that contain either 'ERROR' or 'WARNING' and also contain 'timeout'. Which three commands can be used to achieve this? (Select THREE).

Select 3 answers
A.grep -v 'ERROR|WARNING' logfile | grep timeout
B.grep -E 'ERROR.*timeout|WARNING.*timeout' logfile
C.grep -E 'ERROR|WARNING' logfile | grep timeout
D.sed -n '/ERROR\|WARNING/p' logfile | grep timeout
E.awk '/ERROR|WARNING/ && /timeout/' logfile
AnswersC, D, E

Correct. First grep selects lines with 'ERROR' or 'WARNING' (using -E), then second grep ensures 'timeout' also appears.

Why this answer

The correct commands are C, D, and E. Option C uses grep -E with alternation to first match lines containing 'ERROR' or 'WARNING', then pipes to another grep for 'timeout', ensuring both patterns appear in any order. Option D uses sed with alternation to print lines containing 'ERROR' or 'WARNING', then pipes to grep for 'timeout'.

Option E uses awk with a condition requiring both patterns. Option B is incorrect because 'ERROR.*timeout|WARNING.*timeout' forces a specific order (e.g., 'timeout' must follow 'ERROR' or 'WARNING'), so it will miss lines where 'timeout' appears before the error/warning. Option A is wrong because -v inverts the match and the pattern lacks -E for alternation.

Thus, only three options (C, D, E) correctly achieve the goal.

Exam trap

Candidates might think grep -E with alternation and chained patterns works like a logical AND, but forcing order with '.*' is not the same as checking both conditions independently.

Full explanation →
437
MCQmedium

After updating the kernel, the system fails to boot and displays 'Error 15: File not found' from GRUB. What is the most likely cause?

A.The GRUB configuration file is missing
B.The kernel image is missing or the path in grub.cfg is incorrect
C.The initramfs image is missing
D.The hard drive has failed
AnswerB

Correct: Error 15 means file not found, likely kernel.

Why this answer

GRUB error 15 indicates that the specified file path in the GRUB configuration (grub.cfg) cannot be found. Since the error occurs after a kernel update, the most likely cause is that the new kernel image file is missing from the boot partition or the path in grub.cfg does not match the actual file location, preventing GRUB from loading the kernel.

Exam trap

The trap here is that candidates often confuse GRUB error 15 with a missing initramfs, but error 15 occurs specifically when the kernel image path is invalid, while a missing initramfs causes a kernel panic after the kernel starts loading.

How to eliminate wrong answers

Option A is wrong because if the GRUB configuration file itself were missing, GRUB would typically drop to a rescue shell or display a different error (e.g., 'file not found' for /boot/grub/grub.cfg), not error 15 specifically. Option C is wrong because a missing initramfs image would cause a kernel panic during boot after the kernel loads, not a GRUB error 15, which occurs before the kernel is executed. Option D is wrong because a hard drive failure would likely produce hardware-related errors (e.g., 'disk read error' or 'drive not ready') rather than a specific GRUB 'file not found' error, and the system would not reach the GRUB menu stage.

Full explanation →
438
MCQhard

A DevOps team uses Git for version control of Ansible playbooks. They notice that a recent commit introduced errors in the playbook. Which Git command sequence should they use to temporarily revert to a previous commit while preserving the faulty commit in history?

A.git checkout HEAD~1
B.git revert HEAD
C.git reset --hard HEAD~1
D.git branch -d faulty-branch
AnswerB

Creates inverse commit, keeps history.

Why this answer

The `git revert HEAD` command creates a new commit that undoes the changes introduced by the most recent commit, effectively reverting the playbook to its previous state while preserving the faulty commit in the project history. This is the correct approach for a team using shared repositories because it maintains a linear, non-destructive history that can be safely pushed to a remote without force-pushing.

Exam trap

The trap here is that candidates confuse `git revert` (which creates a new commit to undo changes) with `git reset` (which removes commits from history), leading them to choose the destructive `git reset --hard` option when the question explicitly requires preserving the faulty commit in history.

How to eliminate wrong answers

Option A is wrong because `git checkout HEAD~1` detaches the HEAD to the previous commit, putting the repository in a detached HEAD state; it does not create a new commit and does not preserve the faulty commit in the active branch history. Option C is wrong because `git reset --hard HEAD~1` permanently removes the faulty commit from the branch history, discarding its changes and rewriting history, which is destructive and dangerous for shared branches. Option D is wrong because `git branch -d faulty-branch` deletes a branch named 'faulty-branch', which does not address reverting the most recent commit on the current branch and is irrelevant to the scenario.

Full explanation →
439
MCQmedium

A security audit reveals that the /etc/shadow file is readable by all users. What is the most appropriate immediate action?

A.chmod 000 /etc/shadow
B.chmod 600 /etc/shadow && chown root:shadow /etc/shadow
C.chmod 640 /etc/shadow
D.chmod 600 /etc/shadow
AnswerB

Sets proper permissions and ownership to root and shadow group.

Why this answer

The /etc/shadow file stores hashed user passwords and must be protected from unauthorized access. The correct command is `chmod 600 /etc/shadow && chown root:shadow /etc/shadow` because it sets the file to be readable and writable only by the owner (root) and changes the group to 'shadow', which is the standard group used by many Linux distributions to allow certain system utilities (like `pwck` or `unix_chkpwd`) to read the file without granting access to all users. This ensures that only root and members of the shadow group can read the file, immediately fixing the security issue.

Exam trap

The XK0-005 exam often tests the misconception that simply setting restrictive permissions (like 600) is sufficient, without also ensuring the correct group ownership (shadow), which is a common oversight in Linux security hardening.

How to eliminate wrong answers

Option A is wrong because `chmod 000 /etc/shadow` removes all permissions for everyone, including root, which would break system authentication and password management utilities that require root to read the file. Option C is wrong because `chmod 640 /etc/shadow` gives read permission to the group, which is typically not the shadow group by default and could still expose the file to unauthorized users if the group is set incorrectly. Option D is wrong because `chmod 600 /etc/shadow` alone does not change the group ownership to 'shadow', so the file might remain accessible to a group that should not have access, failing to follow the principle of least privilege and standard Linux security practices.

Full explanation →
440
Multi-Selecthard

A system administrator is troubleshooting a bash script that fails when run from cron but works when run from the terminal. Which two factors could explain this behavior? (Select TWO.)

Select 2 answers
A.The script uses interactive commands
B.The script uses a different shell interpreter
C.The script uses absolute paths
D.The script runs with a different user ID
E.Different PATH environment variable
AnswersA, E

Commands like read, vi, or those requiring a terminal fail non-interactively.

Why this answer

Interactive commands (e.g., `read`, `select`, or commands that require a TTY) fail when run from cron, as cron does not allocate a terminal. The script expects user input or terminal interaction, which is not available in the cron environment, causing it to hang or error out. Option E is correct because cron runs with a minimal PATH (often `/usr/bin:/bin`), so the script may fail to locate commands that are found in the user's interactive shell PATH (e.g., `/usr/local/bin`).

Exam trap

CompTIA often tests the misconception that cron runs scripts with the same environment as the user's interactive shell, leading candidates to overlook PATH and interactive command issues in favor of user ID or interpreter differences.

Full explanation →
441
MCQhard

A security policy requires auditing of all file access attempts. Which Linux kernel feature should be used?

A.auditd
B.journald
C.syslog
D.sysstat
AnswerA

The audit daemon can be configured to watch file accesses using audit rules.

Why this answer

The `auditd` service is the user-space component of the Linux Audit subsystem, which is the kernel feature designed to record file access events. It uses kernel audit rules (configured via `auditctl`) to capture system calls like `open`, `execve`, and `unlink`, enabling detailed auditing of all file access attempts as required by security policies.

Exam trap

The trap here is that candidates confuse `auditd` with general logging tools like `journald` or `syslog`, assuming any logging service can fulfill file access auditing requirements, but only the Linux Audit subsystem provides the necessary kernel-level system call interception and rule-based filtering.

How to eliminate wrong answers

Option B is wrong because `journald` is a system logging daemon that collects log data from various sources (e.g., kernel, services) and stores it in binary journal files; it does not provide granular, rule-based auditing of individual file access attempts. Option C is wrong because `syslog` is a legacy logging protocol and service (e.g., rsyslog, syslog-ng) that handles message-based logging but lacks the kernel-level system call interception needed for file access auditing. Option D is wrong because `sysstat` is a performance monitoring toolset (e.g., sar, iostat) that reports system activity metrics like CPU and I/O usage, not file access events.

Full explanation →
442
MCQeasy

A Linux administrator is writing a bash script that must exit immediately if any command fails. Which of the following should be included at the beginning of the script?

A.set -e
B.set -o pipefail
C.set -u
D.set -x
AnswerA

Correct. set -e exits on any command failure.

Why this answer

The set -e command causes the shell to exit if any command exits with a non-zero status, which is exactly what is needed to ensure the script stops on failure.

Full explanation →
443
Multi-Selecteasy

An administrator wants to ensure a critical monitoring script runs every day at 2 AM and sends output to a log file. Which THREE items are essential in the crontab entry? (Select THREE.)

Select 3 answers
A.SHELL=/bin/bash
B.RUNLEVEL=3
C.0 2 * * * /usr/local/bin/script.sh
D.MAILTO=admin@example.com
E.PATH=/usr/local/bin:/usr/bin
AnswersA, C, E

If the script uses bash-specific features, setting SHELL is required; otherwise, cron uses /bin/sh.

Why this answer

The SHELL variable in a crontab entry defines which shell interpreter is used to execute the cron job. By default, cron uses /bin/sh, but setting SHELL=/bin/bash ensures that bash-specific syntax, aliases, and features (such as [[ ]] or source) are available for the monitoring script. Without this, the script might fail if it relies on bash extensions.

Exam trap

CompTIA often tests the misconception that MAILTO is required for logging output, when in fact output redirection (e.g., >> /var/log/script.log 2>&1) is what sends output to a file, and MAILTO is only for email delivery.

Full explanation →
444
MCQhard

A system administrator wants to find all files in /var/log that have been modified in the last 7 days and are larger than 10MB, then delete them interactively. Which command accomplishes this?

A.find /var/log -mtime -7 -size 10M -exec rm -i {} \;
B.find /var/log -mtime -7 -size +10M -delete
C.find /var/log -mtime +7 -size +10M -ok rm {} \;
D.find /var/log -mtime -7 -size +10M -ok rm {} \;
AnswerD

Correct flags and interactive deletion with -ok.

Why this answer

find with -mtime -7 (modified within 7 days) and -size +10M (larger than 10MB) and -ok rm {} \; (prompt before deletion) matches the requirement.

Full explanation →
445
MCQmedium

After making changes to /etc/grub.d/ and /etc/default/grub, an administrator needs to regenerate the GRUB2 configuration file. Which command should be used?

A.grub2-install
B.grub2-set-default 0
C.grub2-mkconfig -o /boot/grub2/grub.cfg
D.update-grub
AnswerC

Correct: regenerates grub.cfg.

Why this answer

After modifying /etc/grub.d/ scripts or /etc/default/grub, the GRUB2 configuration file must be regenerated to apply the changes. The command `grub2-mkconfig -o /boot/grub2/grub.cfg` reads the configuration snippets and defaults, then writes the final boot menu configuration to the specified output file. This is the standard method on RHEL/CentOS 7+ and other distributions using GRUB2.

Exam trap

The trap here is that candidates confuse `grub2-mkconfig` with `grub2-install` or `update-grub`, or assume any command with 'grub' in the name will update the configuration, but only `grub2-mkconfig -o` actually rebuilds the file from the source scripts and defaults.

How to eliminate wrong answers

Option A is wrong because `grub2-install` installs GRUB2 to the boot sector of a disk (e.g., MBR or GPT), not regenerate the configuration file. Option B is wrong because `grub2-set-default 0` only sets the default boot entry index in the GRUB environment, it does not rebuild the configuration file. Option D is wrong because `update-grub` is a Debian/Ubuntu-specific wrapper script that calls `grub-mkconfig`; it is not available on RHEL-based systems where `grub2-mkconfig` is the correct command.

Full explanation →
446
MCQeasy

Which of the following directories is defined by the Filesystem Hierarchy Standard (FHS) as containing essential user command binaries that need to be available in single-user mode?

A./sbin
B./opt/bin
C./usr/bin
D./bin
AnswerD

/bin contains essential user command binaries.

Why this answer

/bin contains essential command binaries required for booting and single-user mode.

Full explanation →
447
MCQeasy

A system administrator notices that a Linux server is running low on disk space. Which command should be used to identify which directories are consuming the most space?

A.ls -laR
B.find / -size +100M
C.df -h
D.du -h /path | sort -rh
AnswerD

du with -h and sort -rh lists directories with human-readable sizes sorted largest first.

Why this answer

The `du -h /path | sort -rh` command recursively calculates disk usage for each directory under the specified path, displays sizes in human-readable format (`-h`), and then sorts the output in reverse numerical order (`-rh`), showing the largest directories first. This directly identifies which directories are consuming the most space, which is exactly what the system administrator needs.

Exam trap

The trap here is that candidates often pick `df -h` (Option C) because it shows disk space usage, but it only reports filesystem-level totals, not per-directory breakdowns, which fails to identify the specific directories consuming space.

How to eliminate wrong answers

Option A is wrong because `ls -laR` lists all files and directories recursively with details, but it does not sum or sort disk usage; it only shows file sizes individually, making it impractical for identifying the largest directories. Option B is wrong because `find / -size +100M` finds files larger than 100 MB, not directories, and it does not aggregate disk usage per directory; it also may miss smaller files that collectively consume significant space. Option C is wrong because `df -h` reports free and used disk space on mounted filesystems, not per-directory usage; it cannot show which directories are consuming space within a filesystem.

Full explanation →
448
MCQeasy

A technician needs to ensure a service can listen on TCP port 8443 using firewalld. Which command permanently adds the port to the default zone?

A.firewall-cmd --add-port=8443/tcp --permanent
B.firewall-cmd --add-port=8443 --permanent
C.firewall-cmd --add-port=8443/tcp
D.firewall-cmd --add-service=8443/tcp --permanent
AnswerA

Correctly adds port 8443/tcp permanently.

Why this answer

The correct syntax is firewall-cmd --add-port=8443/tcp --permanent. The other options either omit the protocol, use incorrect syntax, or forget --permanent.

Full explanation →
449
MCQmedium

A web server in a remote data center logs timestamps in UTC, but the operations team wants all logs to reflect the local timezone (America/New_York). Which command changes the system timezone?

A.timedatectl set-time '2025-03-01 12:00:00'
B.timedatectl set-timezone America/New_York
C.timedatectl list-timezones
D.timedatectl set-ntp yes
AnswerB

Sets the system timezone to the specified zone.

Why this answer

The `timedatectl set-timezone` command is the correct way to change the system timezone on a Linux system using systemd. By specifying 'America/New_York', the system will adjust all timestamps to Eastern Time, including those generated by the web server, ensuring logs reflect the local timezone.

Exam trap

The trap here is that candidates confuse setting the timezone with setting the time or enabling NTP, leading them to choose options that adjust the clock rather than the timezone, which does not solve the requirement for local timestamps in logs.

How to eliminate wrong answers

Option A is wrong because `timedatectl set-time` sets the system date and time, not the timezone; it would change the clock to a specific moment but leave the timezone unchanged. Option C is wrong because `timedatectl list-timezones` only displays available timezones without modifying the system configuration. Option D is wrong because `timedatectl set-ntp yes` enables or disables NTP synchronization, which adjusts the clock automatically but does not alter the timezone setting.

Full explanation →
450
Multi-Selectmedium

A Linux administrator uses Podman for container management. Which TWO commands display a list of currently running containers?

Select 2 answers
A.docker ps
B.podman inspect
C.podman images
D.podman container ls
E.podman ps
AnswersD, E

Correct: `podman container ls` is an alias for `podman ps`.

Why this answer

`podman container ls` is the explicit Podman command to list running containers, equivalent to `podman ps`. Option E is also correct because `podman ps` is the standard shorthand for listing running containers in Podman, mirroring Docker's `docker ps` syntax. Both commands display the same output of currently active containers.

Exam trap

The trap here is that candidates may assume `docker ps` works identically in Podman due to CLI compatibility, but the exam expects Podman-native commands, and they may overlook that `podman container ls` is the explicit form while `podman ps` is the shorthand.

Full explanation →
Page 5

Page 6 of 14

Page 7

All pages

1234567891011121314

Practice XK0-006 by domain

Target a specific domain to shore up weak areas.

Services and User ManagementSecurityTroubleshootingAutomation, Orchestration, and ScriptingSystem Management
See all domains with question counts →