CompTIA Linux+ XK0-005 (XK0-005) — Questions 376–450

Why this answer

How to eliminate wrong answers

Option B is wrong because the administrator verified that the Samba configuration has not been changed recently, and the services are running without errors, so corruption is unlikely. Option C is wrong because kernel updates do not change default file system mount options; mount options are set in /etc/fstab or at mount time and are not altered by kernel patches. Option D is wrong because the administrator checked AppArmor logs and found no denials related to smbd, indicating the profile is not blocking network binding.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (at job) is wrong because the 'at' command schedules a one-time task at a specific time, not recurring every 15 minutes. Option C (anacron) is wrong because anacron is designed for tasks that need to run daily, weekly, or monthly, assuming the system may not be running continuously, and it does not support sub-daily intervals like 15 minutes. Option D (cron job) is wrong because while cron can schedule tasks every 15 minutes, the question specifically asks for a systemd unit type, and cron is a separate service, not a systemd unit.

Why this answer

How to eliminate wrong answers

Option B is wrong because an incorrect API endpoint would cause an HTTP error (e.g., 404 or 400) at runtime, not an import error when the script starts. Option C is wrong because lack of internet connectivity would cause a connection timeout or DNS resolution failure during the `requests.get()` call, not an import error when loading the module. Option D is wrong because a syntax error in the import statement would be caught by Python's parser before execution, producing a SyntaxError, not an ImportError; the script works on the workstation, so the import syntax is correct.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because a missing configuration file would typically cause an Init:Error or CreateContainerConfigError, not CrashLoopBackOff, as the container would fail to start at all. Option C is wrong because image pull failures due to authentication issues result in ImagePullBackOff or ErrImagePull, not CrashLoopBackOff. Option D is wrong because an unavailable container image also leads to ImagePullBackOff or ErrImagePull, as the container never starts to crash.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the service name 'httpd' is correct for Apache on RHEL/CentOS/Fedora systems; 'apache2' is used on Debian/Ubuntu, but the question does not specify the distribution, and the administrator used 'httpd' which is standard for the given context. Option B is wrong because 'systemctl start httpd' starts the service immediately but is not required for automatic startup after reboot; enabling the service is sufficient for that purpose. Option D is wrong because 'systemctl daemon-reload' is used to reload systemd manager configuration after unit files change, but it is not needed after enabling a service; enabling only creates symlinks, not unit file modifications.

Why this answer

How to eliminate wrong answers

Option B is wrong because changing the service type to 'forking' is used when the process forks and the parent exits, leaving a child process running; it does not keep the service active after the script finishes if the script itself exits. Option C is wrong because adding 'ExecStop' defines a command to run when the service is stopped, but it does not affect the service state after the main process exits. Option D is wrong because changing the service type to 'simple' is the default and behaves the same as the current configuration—systemd considers the service active only while the main process is running, so it will still show 'inactive (dead)' immediately after the script finishes.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'rpc-bind' opens port 111 for RPC portmapper, which is needed for NFSv3 but not for NFSv4; the question does not specify NFS version, and RHEL 8 defaults to NFSv4, making 'nfs' the required service. Option C is wrong because 'samba' is used for SMB/CIFS file sharing, not NFS, and adding it would not allow NFS mounts. Option D is wrong because 'mountd' is not a standard firewalld service; the NFS mount protocol (rpc.mountd) uses a dynamically assigned port and is typically handled by adding the 'nfs' service or explicitly opening the port range, but 'mountd' as a service name is not valid in firewalld.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because /etc/passwd stores user account information (like UID, home directory, shell) but does not contain sudo privileges; editing it would not grant sudo access. Option B is wrong because simply adding a user to the wheel group does not automatically grant sudo access unless the sudoers file contains an entry like '%wheel ALL=(ALL) ALL'; the group membership alone is insufficient. Option C is wrong because /etc/shadow stores encrypted password hashes and password aging information, not sudo permissions; editing it would not affect sudo access.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because 'find /var/log -mtime +7 -delete' deletes all log files older than 7 days, which may remove important historical logs and does not preserve the latest entries in a controlled manner. Option C is wrong because 'cat /dev/null > /var/log/messages' truncates the file, which destroys all existing log entries in that file, failing to preserve the latest entries. Option D is wrong because 'rm -rf /var/log/*' removes all files and subdirectories in /var/log, including current logs, which is destructive and does not preserve any entries.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `modinfo` displays detailed metadata about a specific kernel module (e.g., author, description, parameters), but it does not list currently loaded modules; it requires the module name as an argument and reads the module file, not runtime state. Option C is wrong because `dmesg` prints the kernel ring buffer messages, which can show panic logs and driver errors, but it does not list currently loaded modules; it is useful for post-mortem analysis but not for a real-time inventory of loaded modules. Option D is wrong because `modprobe -l` is not a valid option in modern Linux; `modprobe` is used to load or unload modules, and listing available modules is done with `modprobe -l` only in older versions (deprecated), but it lists all installable modules, not those currently loaded.

Why this answer

How to eliminate wrong answers

Option A is wrong because `hostnamectl` is used to query or change the system hostname and related settings, not to check the current runlevel or default target. Option B is wrong because `getenforce` is a SELinux command that returns the current enforcement mode (Enforcing, Permissive, or Disabled), and has nothing to do with runlevels or systemd targets. Option D is wrong because `uname -r` prints the kernel release version, not the runlevel or default target.

Why these pairings

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because if the script were not executable, it would fail in both the user's shell and cron, not just cron. Option B is wrong because incorrect line endings (e.g., Windows CRLF) would cause syntax errors in both environments, not selectively in cron. Option C is wrong because if the cron job runs as root, root's PATH typically includes system directories, but the custom directory is unlikely to be in root's PATH either; however, the question states the command is in a custom directory, and the core issue is that cron does not source any user's shell profile, so the PATH is not set to include that custom directory regardless of the user.

Why this answer

How to eliminate wrong answers

Option B is wrong because disabling SELinux entirely (SELINUX=disabled) removes all SELinux protections, which is an insecure and overly broad solution that violates the principle of least privilege; the correct approach is to enable only the specific boolean needed. Option C is wrong because the `httpd_enable_home_dirs` boolean controls whether httpd can access user home directories (e.g., for UserDir), not outbound network connections to a database server. Option D is wrong because changing the SELinux context of `index.html` to `httpd_sys_content_t` affects file access for serving web content, not the ability of httpd to make outbound TCP connections to a remote database.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the SELinux context for SSL certificate files should be cert_t or httpd_sys_content_t, but incorrect file context would cause read/access denials, not port binding denials. Option B is wrong because the httpd binary already has the httpd_exec_t context by default when installed via the httpd package; this context is required for execution, not for port binding. Option C is wrong because the httpd_enable_homedirs boolean controls whether httpd can access user home directories, not whether it can bind to HTTPS ports.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because it sets the default policy to DROP but then adds a rule that accepts all TCP traffic regardless of destination port, which would allow all TCP-based traffic (including SSH, SMTP, etc.), not just HTTP and HTTPS. Option B is wrong because it sets the default policy to ACCEPT, which allows all incoming traffic by default, and then adds ACCEPT rules for ports 80 and 443 (which are redundant since the default already accepts everything), and finally adds a DROP rule that would only affect packets not matched by the earlier ACCEPT rules — but because the default policy is ACCEPT, the final DROP rule is effectively useless for traffic that doesn't match the earlier rules (since the default already accepts it). Option D is wrong because it sets the default policy to ACCEPT, which permits all incoming traffic, and then adds ACCEPT rules for ports 80 and 443 (which are unnecessary), but does not include any rule to block other traffic, so all incoming traffic is allowed.

Why this answer

How to eliminate wrong answers

Option B is wrong because /etc/rc.local runs once at system boot, not at a specific daily time like 2:00 AM. Option C is wrong because /etc/cron.daily/ runs once per day but at a system-defined time (typically around 6:25 AM via anacron), not at exactly 2:00 AM, and it cannot be precisely scheduled. Option D is wrong because while a systemd timer can achieve the same result, it requires creating both a service unit and a timer unit, which introduces significantly more configuration overhead compared to a simple crontab entry.

Why this answer

How to eliminate wrong answers

Option B is wrong because reinstalling iptables is unnecessary; the iptables command itself is present and functional (the error is about a missing chain, not a missing binary). Option C is wrong because changing the network driver to macvlan would alter the networking model but does not address the missing iptables chain; the issue is with Docker's default bridge network and its iptables rules. Option D is wrong because updating the kernel is not required; the error stems from a configuration mismatch between Docker and iptables, not a kernel compatibility issue.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `--privileged` grants the container all capabilities and full access to all host devices, which is excessive and a security risk; it is not the targeted solution for accessing a specific device like a USB drive. Option C is wrong because `--pid=host` shares the host's PID namespace with the container, allowing the container to see all host processes, but it does not provide any access to host devices. Option D is wrong because `--net=host` makes the container use the host's network stack directly, which affects networking only and has no effect on device access.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'PasswordAuthentication yes' would enable password authentication, which is the opposite of the required outcome. Option B is wrong because 'PubkeyAuthentication no' would disable public key authentication, preventing key-based access entirely. Option C is wrong because /etc/ssh/ssh_config is the client-side configuration file; modifying it only affects outgoing SSH connections from that host, not incoming connections to the SSH server.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `sealert` is a GUI tool that analyzes SELinux denial messages and provides human-readable explanations, but it does not directly show the raw denials from the audit log; it requires the denials to already be present in the audit log or to be run with a specific file. Option C is wrong because `getenforce` only displays the current SELinux mode (Enforcing, Permissive, or Disabled) and does not show any denial logs. Option D is wrong because `audit2why` interprets AVC denial messages from audit logs and explains why access was denied, but it does not show the denials themselves; it requires input from `ausearch` or a log file to function.

Why this answer

Why this answer

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because `panic=10` sets a timeout in seconds after which the system automatically reboots on a kernel panic, but it does not enable crash dump capture. Option B is wrong because `kdump_enabled=1` is not a valid kernel parameter; the kdump service is controlled via systemd or init scripts, not a kernel boot parameter. Option C is wrong because `irqpoll` is a kernel parameter used to work around interrupt problems by polling IRQs, and it has no role in crash dump capture.

Why this answer

How to eliminate wrong answers

Option A is wrong because it sets the default INPUT policy to ACCEPT, which allows all incoming traffic by default, then adds ACCEPT rules for ports 22 and 443 — this does not deny other traffic, it just redundantly accepts those ports. Option C is wrong because it sets the default policy on the FORWARD chain to DROP, but the requirement is about incoming traffic to the local system, which is governed by the INPUT chain, not FORWARD; the INPUT chain's default policy remains ACCEPT, so all incoming traffic is still allowed. Option D is wrong because it sets the default INPUT policy to ACCEPT and then adds DROP rules for ports 22 and 443, which would block SSH and HTTPS while allowing all other traffic — the exact opposite of the requirement.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `top -o %MEM` sorts processes by memory usage interactively, but the `-o` flag is not a valid option for the `top` command in most Linux distributions; the correct syntax is `top -o %MEM` (with a space) or simply pressing 'M' inside top, but the given command would fail or produce an error. Option B is wrong because `vmstat 1 5` reports system-wide virtual memory statistics (processes, memory, paging, block I/O, traps, and CPU activity) at one-second intervals for five samples, but it does not list individual processes or sort them by memory usage. Option D is wrong because `free -m` displays total, used, and free physical and swap memory in megabytes, but it provides no information about individual processes or their memory consumption.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `AllowUsers` specifies individual usernames, not groups; `AllowUsers sshusers` would only allow a user literally named 'sshusers', not members of the group. Option B is wrong because `DenyUsers` explicitly denies specific users; `DenyUsers sshusers` would block the user named 'sshusers', which is the opposite of the requirement. Option D is wrong because `PermitRootLogin no` only prevents root from logging in via SSH, but does nothing to restrict access based on group membership.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because pre-receive is a server-side hook that runs on the remote repository after the push is received, so it cannot prevent the push from being sent from the client. Option B is wrong because pre-commit runs before each commit is created, not before a push, so it cannot enforce that all commits in a push pass tests. Option C is wrong because post-commit runs after a commit is created and cannot abort the commit or push, making it useless for blocking broken commits from being pushed.

Why this answer

How to eliminate wrong answers

Option A is wrong because /etc/mtab is a dynamically generated file that lists currently mounted filesystems; modifying it does not persist mount options across reboots. Option C is wrong because /etc/sysconfig/network is used for network configuration (e.g., hostname, gateway) and has no role in filesystem mount options. Option D is wrong because /etc/security/limits.conf is used to set per-user resource limits (e.g., file size, number of processes) via PAM, not to control filesystem mount behavior.

Why this answer

How to eliminate wrong answers

Option A is wrong because filesystem errors in /etc/fstab would typically cause a failure during the mount of additional filesystems after the root is already mounted, not a kernel panic at boot before the root filesystem is accessed. Option B is wrong because a faulty memory module usually causes random crashes, kernel panics with memory-related errors, or system instability, not a specific VFS root mount failure with unknown-block(0,0). Option C is wrong because a missing or corrupted boot loader would prevent the kernel from being loaded at all, resulting in a blank screen or a 'boot device not found' error, not a kernel panic after the kernel has started executing.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `-k identity` only adds a key label to the audit record but does not specify any permission filters (`-p`), so it would log all accesses (read, write, execute, attribute change) to `/etc/shadow`, not just write operations. Option B is wrong because `-p rwxa` monitors read (`r`), write (`w`), execute (`x`), and attribute change (`a`) — this is overly broad and would generate excessive audit records for reads and executes, not just writes. Option C is wrong because `-a always,exit -S open -F path=/etc/shadow` uses the `open` syscall, which captures file opens but not all write operations (e.g., writes via `write` syscall on an already open file descriptor would be missed); it also lacks the `-p wa` permission filter that directly targets write and attribute changes.

Why this answer

How to eliminate wrong answers

Option A is wrong because the default policy of ACCEPT on the INPUT chain would allow traffic by default, but the explicit DROP rule for port 80 overrides that default, so the default policy is not the cause. Option B is wrong because RELATED traffic is associated with connection tracking (e.g., FTP data connections) and is not relevant to HTTP traffic on port 80; the issue is a direct DROP rule, not a missing RELATED rule. Option D is wrong because while it correctly allows traffic from 192.168.1.0/24 to port 80, it is placed after the DROP rule (line order matters in iptables), so the DROP rule is matched first and the ACCEPT rule is never evaluated.

Why this answer

How to eliminate wrong answers

Option B is wrong because `setenforce 0` disables SELinux entirely (sets it to permissive mode), which is a drastic measure that bypasses all SELinux protections rather than fixing the specific file context issue. Option C is wrong because `restorecon -v` restores the file's SELinux context to the default policy-defined type, which would only help if the current context is incorrect and the default matches the expected type; it does not set a custom type like `httpd_sys_content_t`. Option D is wrong because `semanage fcontext -a -t httpd_sys_content_t /var/www/html` adds a persistent rule to the SELinux policy for the file, but it does not immediately apply the context to the file; a subsequent `restorecon` or `touch` is required to activate the change, so it is not a temporary fix.

Why this answer

How to eliminate wrong answers

Option A is wrong because overlay2 is a storage driver and has no direct compatibility issue with the systemd cgroup driver; the warning is about cgroup driver mismatch, not storage. Option C is wrong because the 'user' directive in nginx is unrelated to container privilege reduction; the warning originates from Docker's cgroup driver check, not from nginx's runtime behavior. Option D is wrong because the log driver configuration does not cause warnings about the 'user' directive; log driver settings affect log output format and destination, not cgroup driver validation.

Why this answer

How to eliminate wrong answers

Option A is wrong because `git rebase 1m2n3o4` while on `feature/update` would replay the feature branch commits onto commit 1m2n3o4, but this would still include the 'Add new module' commit if it is part of the feature branch history, and does not create a new release branch. Option C is wrong because `git revert 2j3k4l5` would create a new commit that undoes the 'Add new module' commit, but the release branch would still contain that commit in its history, which violates the requirement to not include it at all. Option D is wrong because merging `master` into a branch based on `feature/update` would bring in all commits from master, including the 'Add new module' commit, which is explicitly unwanted.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 'systemctl restart ntp' targets the legacy 'ntpd' service, which is not the active NTP service when chronyd is in use; the output shows 'NTP service: active' but does not specify the daemon, and on modern systems chronyd is the default, so restarting ntpd would have no effect or could conflict. Option B is wrong because 'ntpdate' is deprecated and often not installed by default; it also bypasses the running NTP service and can cause clock stepping that may disrupt applications, and it does not integrate with the active chronyd or ntpd configuration. Option C is wrong because 'systemctl restart chronyd' restarts the daemon but does not force an immediate synchronization; chronyd will still wait for its next scheduled poll (typically 64–1024 seconds), so the 5-minute lag would persist until the next automatic update.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because running `fsck` on an inactive logical volume will fail or cause corruption; the filesystem must be active and accessible before checking. Option C is wrong because `vgchange -ay` activates all volume groups, which is unnecessary and could interfere with other LVM states; the issue is isolated to a single LV, so targeting it with `lvchange` is more precise. Option D is wrong because `mount` will fail if the logical volume is inactive; the LV must be activated first before any mount attempt.

Why this answer

How to eliminate wrong answers

Option B is wrong because `chmod +x script.sh` adds execute permission for all three categories (user, group, others) by default when no target is specified, which is overly permissive and violates the principle of least privilege. Option C is wrong because `chmod g-x script.sh` removes execute permission from the group, which does not help make the script executable; it actually reduces permissions. Option D is wrong because `chmod a+rwx script.sh` grants read, write, and execute permissions to all users (user, group, others), which is excessively permissive and unnecessary for the administrator's goal.

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because the error message is 'Input/output error', not 'Permission denied', and the user's lack of read permissions would produce a different error. Option C is wrong because the mount command shows /dev/sdb1 is present and mounted on /data, so the device exists. Option D is wrong because the mount output shows 'rw' (read-write) in the mount options, and a read-only mount would produce a 'Read-only file system' error, not an I/O error.

Why this answer

How to eliminate wrong answers

Option A is wrong because the shebang line must be on the first line of the script; if it is not, the script will still execute but will be interpreted by the default shell (usually /bin/sh) rather than bash, which may cause different behavior but not necessarily a failure to run. Option C is wrong because using #!/bin/sh instead of #!/bin/bash does not cause the script to fail to run; it simply invokes the system's default Bourne shell, which may lack some bash-specific features but will still execute the script if it is compatible. Option D is wrong because a byte order mark (BOM) at the start of the script is a Unicode encoding artifact that can cause the shebang line to be misinterpreted, but it is less common than carriage return issues and typically results in a 'bad interpreter' error similar to \r, but the question specifically tests the more frequent Windows-to-Linux line-ending problem.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a missing service binary would cause a different error, such as 'Exec format error' or 'Unit not found' when trying to execute the binary, not a parsing failure. Option C is wrong because a missing dependency typically results in 'dependency failed' or 'unit not found' errors, not an 'Invalid argument' syntax error. Option D is wrong because a masked service produces 'Unit is masked' or 'Failed to start unit: Unit is masked' errors, not a syntax-level parsing failure.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `rescue` is not a valid GRUB command; it is a mode in systemd or anaconda, not used at the GRUB prompt. Option B is wrong because `reboot` is a system command, not a GRUB command; at the GRUB prompt, you would use `reboot` only after exiting GRUB or from the OS shell. Option D is wrong because `exit` in GRUB returns to the previous menu or the BIOS/UEFI boot selection, but does not attempt to load the operating system.