CompTIA Linux+ (XK0-006) XK0-006 Questions 451–525 | Page 7/14

451

MCQmedium

A system administrator wants to find all files in /var/log that have been modified in the last 7 days and are larger than 100MB. Which command should be used?

A.find /var/log -mtime +7 -size +100M

B.find /var/log -atime -7 -size +100M

C.find /var/log -mtime -7 -size +100M

D.find /var/log -mtime -7 -size -100M

AnswerC

Correct: -mtime -7 for last 7 days, -size +100M for >100MB.

Why this answer

The -mtime -7 finds files modified within 7 days, -size +100M finds files larger than 100MB.

Full explanation →

452

Multi-Selectmedium

An administrator is managing a server using systemd and needs to control services and units. Which THREE of the following are valid systemd commands for service management? (Choose three.)

Select 3 answers

A.service start

B.systemctl mask

C.systemctl start

D.systemctl enable

E.chkconfig on

AnswersB, C, D

Masks a unit, preventing it from being started.

Why this answer

B is correct because 'systemctl mask' creates a symlink to /dev/null, making a unit completely unavailable and preventing it from being started manually or by dependencies. This is a valid systemd command for service management.

Exam trap

Candidates often confuse SysV init commands (service, chkconfig) with systemd commands (systemctl). On the Linux+ exam, remember that systemd uses systemctl for service management, not the legacy SysV commands.

Full explanation →

453

MCQmedium

A Bash script contains the following function: ```bash myfunc() { local result="$(( $1 + $2 ))" echo "$result" } ``` If the script calls `myfunc 5 10`, what is the output?

A.510

B.5+10

C.the function returns nothing

D.15

AnswerD

The arithmetic expansion $((5+10)) yields 15.

Why this answer

The function adds the two arguments (5+10=15) and echoes the result, which is 15.

Full explanation →

454

Multi-Selectmedium

In a bash script, a function is defined to calculate a value. Which TWO of the following are valid ways to return a value from the function to the caller? (Select TWO).

Select 2 answers

A.exit 42

B.echo 42

C.return 42

D.return 'value'

E.print 42

AnswersB, C

Prints 42 to stdout; caller can capture with result=$(function).

Why this answer

The return statement sets the exit status (0-255). echo outputs to stdout which can be captured via command substitution. Functions cannot return arbitrary integers directly via return if >255.

Full explanation →

455

MCQeasy

A system administrator notices that a server's disk space is critically low. Which command should be used to identify the largest files or directories consuming space?

A.ls -la /

B.fdisk -l

C.df -h

D.du -sh /*

AnswerD

Summarizes disk usage for each top-level directory in human-readable format.

Why this answer

`du -sh /*` recursively calculates disk usage for each top-level directory and file under root, summarizing sizes in human-readable format. This directly identifies the largest space consumers, which is the stated goal. The `-s` flag provides a total per argument, and `/*` targets all immediate children of `/`.

Exam trap

The trap here is that candidates confuse `df -h` (filesystem-level usage) with `du` (directory-level usage), mistakenly thinking `df` can identify specific large files or directories when it only shows aggregate mount-point consumption.

How to eliminate wrong answers

Option A is wrong because `ls -la /` lists file names, permissions, and metadata but does not show disk usage or sort by size, making it useless for identifying largest consumers. Option B is wrong because `fdisk -l` displays partition table information (sectors, start/end blocks) and is used for disk partitioning, not for measuring file or directory sizes. Option C is wrong because `df -h` shows free and used space on mounted filesystems as a whole, not the breakdown of which files or directories are consuming that space.

Full explanation →

456

Multi-Selecteasy

A security team wants to implement mandatory access control (MAC) on a Linux server to confine a potentially vulnerable daemon. Which TWO of the following technologies can be used for this purpose?

Select 2 answers

A.sudo

B.AppArmor

C.SELinux

D.TCP wrappers

E.iptables

AnswersB, C

AppArmor is another Linux MAC implementation using profiles.

Why this answer

AppArmor is a Linux Security Module (LSM) that implements mandatory access control (MAC) by confining programs to a set of listed files and capabilities defined in profiles. It operates on a path-based model, allowing the security team to restrict the daemon's access to only necessary resources, effectively containing a potential vulnerability.

Exam trap

The trap here is that candidates may confuse network-level controls (TCP wrappers, iptables) or privilege escalation tools (sudo) with mandatory access control, which specifically restricts what a process can do on the local system regardless of the user running it.

Full explanation →

457

MCQeasy

Which command can be used to display the current user's effective user ID and group memberships?

A.id

B.who

C.groups

D.whoami

AnswerA

Displays UID, GID, and supplementary groups.

Why this answer

The `id` command displays the current user's real and effective user ID (UID), group ID (GID), and supplementary group memberships. It provides a comprehensive view of identity and group associations, which is essential for understanding access rights in Linux security contexts.

Exam trap

CompTIA often tests the distinction between `whoami` (which shows only the effective username) and `id` (which shows both the effective user ID and group memberships), leading candidates to choose `whoami` when the question asks for the effective user ID and group memberships together.

How to eliminate wrong answers

Option B is wrong because `who` lists currently logged-in users with session details (e.g., login time, terminal), not the effective user ID or group memberships of the current user. Option C is wrong because `groups` only shows the group memberships of the current user (or a specified user) but does not display the effective user ID or the numeric UID/GID values. Option D is wrong because `whoami` prints only the current effective username, not the numeric user ID or any group membership information.

Full explanation →

458

MCQeasy

A user can access a web server on this Linux system via HTTPS but cannot connect via SSH. Based on the exhibit, what is the most likely cause?

A.The SSH service is not running.

B.The eth0 interface is down.

C.The firewall is missing a rule to allow SSH traffic.

D.The INPUT chain default policy is DROP.

AnswerC

Only HTTPS is allowed; SSH packets are dropped by the default DROP policy.

Why this answer

The exhibit likely shows that the INPUT chain has a default policy of DROP and contains an explicit rule to allow HTTPS (port 443) but no rule to allow SSH (port 22). With a default DROP policy, only traffic matching explicit allow rules passes. Since SSH traffic does not match any allow rule, it is dropped, preventing SSH connections while HTTPS (with an explicit rule) works.

Therefore, the most likely cause is that the firewall is missing a rule to allow SSH traffic.

Exam trap

Candidates often assume that because HTTPS works, SSH should also work. However, if the firewall has a default DROP policy, explicit allow rules are required for each service. The presence of an HTTPS rule does not imply SSH is allowed; each service must be explicitly permitted.

How to eliminate wrong answers

Option A is wrong because if the SSH service were not running, the connection would be refused immediately (TCP RST), but the question states the user cannot connect, which could also be due to a firewall block; however, the exhibit likely shows the SSH service is running (e.g., port 22 is listening) or the issue is firewall-related. Option B is wrong because if the eth0 interface were down, the user would not be able to access the web server via HTTPS either, as both HTTPS and SSH rely on the same network interface. Option D is wrong because if the INPUT chain default policy were DROP, then HTTPS traffic would also be blocked unless there is an explicit ACCEPT rule for it; the exhibit shows HTTPS is accessible, so the default policy cannot be DROP (or there is an ACCEPT rule for HTTPS but not SSH, making the missing rule the specific cause, not the default policy itself).

Full explanation →

459

MCQhard

A systemd timer unit is configured to run a service every hour but the service never executes. The timer shows as active and enabled. Which of the following is the most likely cause?

A.The service unit is masked

B.The timer is not started

C.The service unit is not enabled

D.The timer unit has a mistake in the OnCalendar directive

AnswerA

A masked service cannot be started by any method, including timers.

Why this answer

When a systemd timer unit is active and enabled but the associated service never executes, the most likely cause is that the service unit is masked. A masked unit is symlinked to /dev/null, which prevents systemd from starting it regardless of timer triggers. The timer itself runs correctly, but systemd silently ignores the request to activate the masked service.

Exam trap

The trap here is that candidates confuse 'masked' with 'disabled' or assume a timer will still start a disabled service, but systemd will not start a masked service under any circumstances.

How to eliminate wrong answers

Option B is wrong because the timer is explicitly stated as active and enabled, meaning it has been started. Option C is wrong because the service unit does not need to be enabled for a timer to start it; the timer activation is independent of the service's enablement status. Option D is wrong because if the OnCalendar directive had a mistake, the timer would likely show as inactive or fail to trigger, but the question states the timer is active and enabled, implying the directive is syntactically correct.

Full explanation →

460

MCQmedium

A service named 'myapp' is currently running but should be disabled so it does not start automatically at boot. Which command accomplishes this?

A.systemctl disable myapp

B.systemctl kill myapp

C.systemctl mask myapp

D.systemctl stop myapp

AnswerA

Disable removes the 'wants' or 'requires' symlinks, preventing automatic startup.

Why this answer

The correct command is `systemctl disable myapp` because it removes the symlinks that cause the service to start automatically at boot, while leaving the currently running service unaffected. This directly meets the requirement of disabling automatic startup without stopping the running process.

Exam trap

The trap here is that candidates confuse 'disable' with 'stop' or 'mask', mistakenly thinking that stopping a service also prevents it from starting at boot, or that masking is the same as disabling when it actually prevents all manual and automatic starts.

How to eliminate wrong answers

Option B is wrong because `systemctl kill myapp` sends a signal to the service's processes to terminate them, which stops the service but does not prevent it from starting at boot. Option C is wrong because `systemctl mask myapp` creates a strong symlink to `/dev/null`, making the service impossible to start manually or automatically, which goes beyond the requirement of simply disabling automatic startup. Option D is wrong because `systemctl stop myapp` immediately halts the running service but does not change its boot-time enablement status, so it would still start on the next reboot.

Full explanation →

461

MCQeasy

Which command is used to query the status of a service managed by systemd?

A.journalctl -u servicename

B.service servicename status

C.systemctl list-units --type=service

D.systemctl status servicename

AnswerD

Correct: systemctl status shows service status.

Why this answer

systemctl status shows whether a service is active, enabled, and recent log entries.

Full explanation →

462

MCQhard

An administrator runs 'auditctl -w /etc/passwd -p wa -k passwd_changes' to monitor changes to /etc/passwd. Which command should be used to search the audit log for all events related to this watch?

A.ausearch -k passwd_changes

B.auditctl -l -k passwd_changes

C.tail -f /var/log/audit/audit.log | grep passwd_changes

D.aureport -k passwd_changes

AnswerA

Correct. ausearch with -k searches for audit events with that key.

Why this answer

The `ausearch -k passwd_changes` command is correct because it searches the audit log for events that were tagged with the key `passwd_changes` when the watch was created via `auditctl -w /etc/passwd -p wa -k passwd_changes`. The `-k` option in `auditctl` assigns a key to the rule, and `ausearch` uses that same key to filter and retrieve matching audit records from `/var/log/audit/audit.log`.

Exam trap

The trap here is that candidates confuse `ausearch` (for searching logs) with `aureport` (for generating summaries) or `auditctl -l` (for listing rules), leading them to pick a command that does not actually retrieve historical audit events.

How to eliminate wrong answers

Option B is wrong because `auditctl -l -k passwd_changes` lists currently loaded audit rules, not search results from the audit log; it would show the rule itself, not events. Option C is wrong because `tail -f /var/log/audit/audit.log | grep passwd_changes` is a raw log tail with grep, which is inefficient and unreliable for structured audit log searching, and it does not use the dedicated `ausearch` tool that properly parses audit records. Option D is wrong because `aureport -k passwd_changes` generates summary reports of audit events, not a detailed event listing; it aggregates data and does not output individual audit records like `ausearch` does.

Full explanation →

463

Multi-Selecteasy

A user cannot log in to a Linux system via SSH, but the SSH service is running and network connectivity is fine. Which TWO commands should the administrator use to troubleshoot the issue? (Choose TWO.)

Select 2 answers

A.journalctl -u sshd -n 20

B.cat /etc/ssh/sshd_config

C.passwd -S username

D.ss -tlnp | grep :22

E.grep '^username:' /etc/passwd

AnswersA, E

View recent SSH daemon logs for authentication errors.

Why this answer

`journalctl -u sshd -n 20` displays the last 20 log entries for the SSH daemon (sshd). This allows the administrator to see authentication failures, configuration errors, or other SSH-specific issues that prevent login, even when the service is running and network connectivity is fine.

Exam trap

The trap here is that candidates often choose `ss -tlnp | grep :22` (Option D) because they think verifying the port is listening is the first step, but the question explicitly states the service is running and network is fine, making this command redundant and not a troubleshooting step for the user-specific login failure.

Full explanation →

464

MCQmedium

A script receives a JSON object where keys are user IDs. Which command extracts the 'status' of user id '123'?

A.echo "$json" | jq '.status'

B.echo "$json" | jq '. | select(.id=="123") | .status'

C.echo "$json" | jq '.[] | select(.id=="123") | .status'

D.echo "$json" | jq '.["123"].status'

AnswerD

Correctly accesses the object by key and extracts status.

Why this answer

The JSON object uses user IDs as keys, so `.["123"]` directly accesses the object property for user ID '123', and `.status` extracts the 'status' field from that nested object. The `jq` syntax `.["key"]` is the standard way to access a property by a string key in a JSON object.

Exam trap

The trap here is that candidates often default to using `select(.id=="123")` as if the JSON were an array of objects with an 'id' field, failing to recognize that the user IDs are the object keys themselves, requiring direct key access with `.["123"]`.

How to eliminate wrong answers

Option A is wrong because `.status` attempts to access a top-level 'status' key, but the JSON object's top-level keys are user IDs, not 'status'. Option B is wrong because `. | select(.id=="123")` assumes the JSON is an array of objects with an 'id' field, but the input is an object keyed by user IDs, not an array. Option C is wrong because `.[]` iterates over the values of the object, but then `select(.id=="123")` again incorrectly expects an 'id' field within each value, whereas the user ID is the key, not a field inside the value.

Full explanation →

465

Multi-Selecthard

An administrator needs to configure iptables to allow incoming SSH traffic only from the 10.0.0.0/8 network and drop all other incoming traffic except established connections. Which TWO rules are necessary?

Select 2 answers

A.iptables -A INPUT -p tcp --dport 22 -j DROP

B.iptables -P INPUT DROP

C.iptables -A INPUT -j DROP

D.iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT

E.iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

AnswersD, E

Allows SSH from the 10.0.0.0/8 network.

Why this answer

It explicitly allows incoming SSH traffic (TCP port 22) from the 10.0.0.0/8 network, which matches the requirement to permit SSH only from that subnet. Option E is correct because it accepts all packets that are part of an established or related connection, ensuring that return traffic for outbound connections is not dropped by the default policy or subsequent rules.

Exam trap

The trap here is that candidates often forget to include the rule for established connections (Option E) and mistakenly think setting a default DROP policy (Option B) or a blanket DROP rule (Option C) alone is sufficient, not realizing that without allowing established traffic, all return packets are dropped, breaking connectivity.

Full explanation →

466

Multi-Selecteasy

Which TWO commands can be used to change the group ownership of a file? (Choose exactly two.)

Select 2 answers

A.chmod

B.chgrp

C.groupmod

D.chown

E.usermod

AnswersB, D

chgrp directly changes the group of a file.

Why this answer

The `chgrp` command is specifically designed to change the group ownership of a file or directory. The `chown` command can also change group ownership when used with the colon syntax (e.g., `chown :groupname file`). Both commands modify the file's group ID (GID) in the inode metadata.

Exam trap

The trap here is that candidates often forget `chown` can change group ownership using the colon syntax (e.g., `chown :group file`), leading them to select only `chgrp` or incorrectly choose `chmod` or `groupmod`.

Full explanation →

467

MCQhard

A system administrator is troubleshooting a Docker container that exits immediately after starting. The container is built from a minimal image that runs a short-lived command. Which change will keep the container running?

A.Modify the Dockerfile to use CMD ["sh"] instead of CMD ["echo", "hello"]

B.Use -d flag to run in detached mode

C.Restart the container with --restart=always

D.Allocate a pseudo-TTY with -t flag

AnswerA

Running a shell as the main process will keep the container running indefinitely.

Why this answer

The container exits immediately when its main process finishes. By changing the CMD from `["echo", "hello"]` (which prints a message and exits) to `["sh"]`, the container runs an interactive shell that waits for input, keeping the process alive and the container running. In Docker, a container lives only as long as its PID 1 process runs.

Exam trap

CompTIA often tests the misconception that detached mode (`-d`) or restart policies (`--restart=always`) can keep a container running indefinitely, but the core requirement is that the container's main process must not terminate.

How to eliminate wrong answers

Option B is wrong because the `-d` flag runs the container in detached mode, but it does not change the fact that the command inside the container is short-lived; the container will still exit immediately after the command finishes. Option C is wrong because `--restart=always` only restarts the container after it exits, but it does not prevent the immediate exit; the container will keep restarting in a loop rather than staying running continuously. Option D is wrong because allocating a pseudo-TTY with `-t` does not keep the container alive; it only provides a terminal interface, but if the command finishes, the container still exits.

Full explanation →

468

MCQhard

A security team requires that all scripts run from a specific directory must be signed with a GPG key before execution. Which Linux feature can enforce this policy?

A.IMA/EVM with fs-verity

B.setuid bit

C.dm-verity

D.SELinux boolean

AnswerA

IMA/EVM can enforce that files are signed and verified before execution.

Why this answer

IMA/EVM (Integrity Measurement Architecture / Extended Verification Module) with fs-verity is the correct choice because it provides file-level integrity enforcement by requiring a valid GPG signature on scripts before execution. fs-verity enables per-file Merkle tree verification, and IMA can be configured to measure and enforce signatures, ensuring only signed scripts from the specified directory are allowed to run.

Exam trap

The trap here is that candidates confuse dm-verity (block-level integrity for read-only filesystems) with fs-verity (file-level integrity for mutable files), leading them to choose dm-verity despite it not supporting per-file signing enforcement.

How to eliminate wrong answers

Option B is wrong because the setuid bit allows a script to run with the permissions of its owner, not enforce GPG signing; it has no integrity verification capability. Option C is wrong because dm-verity provides block-level integrity verification for read-only block devices (e.g., system partitions), not per-file signing enforcement for scripts in a directory. Option D is wrong because SELinux booleans toggle policy features (e.g., allowing or denying certain operations) but cannot enforce GPG signature requirements on scripts; they lack cryptographic verification.

Full explanation →

469

Multi-Selectmedium

In an Ansible playbook, which THREE of the following are valid modules for managing files and packages? (Select THREE).

Select 3 answers

A.get_url

B.copy

C.apt

D.file

E.command

AnswersB, C, D

Copies files to remote hosts.

Why this answer

(copy) is correct because the copy module is a dedicated Ansible module for copying files from the local control node to remote hosts, supporting attributes like owner, permissions, and content. It is the standard idempotent way to manage file distribution in playbooks.

Exam trap

CompTIA Linux+ often tests the distinction between modules that manage state (copy, file, apt) versus modules that execute commands (command) or retrieve remote content (get_url), trapping candidates who think any module that touches a file is a 'file management' module.

Full explanation →

470

MCQhard

A Linux system is using systemd and a service fails to start. The administrator checks the service journal and sees: 'Failed to start service: Unit not found'. However, the service file exists in /etc/systemd/system/. What is the most likely cause?

A.The service is masked

B.systemd has not been reloaded (systemctl daemon-reload)

C.The service file has incorrect permissions

D.The service is enabled but not started

AnswerB

Correct: Requires daemon-reload to recognize new unit.

Why this answer

When a service file is added or modified in /etc/systemd/system/, systemd does not automatically re-read the unit files. The administrator must run 'systemctl daemon-reload' to instruct systemd to scan for new or changed unit files. Without this reload, systemd still references its cached list of units, resulting in 'Unit not found' even though the file exists on disk.

Exam trap

The trap here is that candidates assume systemd automatically detects new unit files in the filesystem, when in fact it requires an explicit 'daemon-reload' to refresh its unit cache.

How to eliminate wrong answers

Option A is wrong because a masked service would produce a different error message, such as 'Unit is masked', not 'Unit not found'. Option C is wrong because systemd unit files with incorrect permissions (e.g., not readable by root) would typically cause a 'Permission denied' error or a failure to load the unit, not a 'Unit not found' message. Option D is wrong because 'enabled but not started' describes a service that is configured to start at boot but is currently stopped; this would not cause a 'Unit not found' error when attempting to start it manually.

Full explanation →

471

MCQeasy

A system administrator wants to create a new user and set a password in a single command as part of a provisioning script. Which command accomplishes this?

A.passwd user1 password

B.echo 'user1:password' | chpasswd

C.useradd -m -p password user1

D.usermod -p password user1

AnswerB

correctly reads from stdin.

Why this answer

The `chpasswd` command reads username:password pairs from standard input, allowing a single command to create or update a user's password. When combined with `echo`, it sets the password for a new or existing user in one line, which is ideal for provisioning scripts. The `-p` option in `useradd` expects an already-hashed password, not a plaintext one, and `passwd` does not accept the password as an argument for security reasons.

Exam trap

The trap here is that candidates often assume `passwd` or `useradd -p` can accept a plaintext password directly, but the exam tests the understanding that these commands require either interactive input or a pre-hashed password, making `chpasswd` the correct choice for a single-command plaintext password set.

How to eliminate wrong answers

Option A is wrong because `passwd` does not accept the password as a command-line argument; it prompts interactively or reads from stdin, and passing the password directly would expose it in the process list and is not supported. Option C is wrong because `useradd -p` expects a hashed password string, not a plaintext password; using a plaintext password here would either fail or store an invalid hash, and the password would not be set correctly. Option D is wrong because `usermod -p` also expects a hashed password, not plaintext, and the command would not set the password as intended; additionally, `usermod` modifies an existing user, not creating a new one.

Full explanation →

472

Multi-Selecteasy

Which TWO of the following are best practices for securing the GRUB boot loader?

Select 2 answers

A.Enable Secure Boot.

B.Encrypt the boot partition.

C.Set a GRUB password.

D.Set the boot timeout to 0.

E.Disable USB boot.

AnswersB, C

Protects boot files from tampering.

Why this answer

Setting a GRUB password (option C) prevents unauthorized users from editing boot parameters or booting into single-user mode, which could otherwise bypass system authentication. Encrypting the boot partition (option B) protects the integrity and confidentiality of the kernel and initramfs, ensuring that tampered or malicious code cannot be loaded during boot. Both measures are recommended in security baselines to enforce boot‑level access control.

Exam trap

CompTIA often tests the distinction between GRUB‑specific controls (password, encryption) and platform‑level settings (Secure Boot, USB boot order), leading candidates to mistakenly select Secure Boot or disable USB boot as GRUB best practices.

Full explanation →

473

Multi-Selectmedium

A Linux administrator is troubleshooting a slow system. They decide to use vmstat to get an overall picture. Which two of the following fields in vmstat output are most directly related to CPU performance issues? (Choose two.)

Select 2 answers

A.id (idle time)

B.wa (I/O wait time)

C.sy (system CPU time)

D.r (run queue)

E.us (user CPU time)

AnswersC, E

High sy indicates CPU is busy with kernel tasks.

Why this answer

The 'us' field shows user time, 'sy' shows system time, 'id' shows idle, and 'wa' shows I/O wait. High 'us' or 'sy' can indicate CPU-bound issues.

Full explanation →

474

MCQeasy

An administrator needs to update the system time using an NTP server immediately without waiting for the next scheduled sync. Which command should be used?

A.timedatectl set-ntp true

B.systemctl start ntpd

C.ntpq -p

D.ntpdate pool.ntp.org

AnswerD

Forces immediate time sync.

Why this answer

The `ntpdate` command is used to immediately synchronize the system clock with an NTP server, bypassing the daemon-based scheduled sync. Option D runs `ntpdate pool.ntp.org`, which performs a one-time query and sets the time instantly, making it the correct choice for an immediate update.

Exam trap

The trap here is that candidates confuse enabling the NTP service (option A or B) with performing an immediate synchronization, not realizing that those commands only start or activate the daemon for gradual, ongoing adjustments rather than an instant update.

How to eliminate wrong answers

Option A is wrong because `timedatectl set-ntp true` enables the NTP service (chronyd or systemd-timesyncd) for ongoing synchronization, but does not trigger an immediate sync. Option B is wrong because `systemctl start ntpd` starts the NTP daemon, which will sync gradually over time, not instantly. Option C is wrong because `ntpq -p` only queries and displays the current NTP peers and their status; it does not perform any time synchronization.

Full explanation →

475

MCQeasy

A technician needs to troubleshoot a network connectivity issue on a Linux server. The server can ping its own IP address but cannot ping the default gateway. Which of the following is the most likely cause?

A.The default gateway is misconfigured in the routing table.

B.The DNS resolver is not configured correctly.

C.The iptables firewall is blocking outgoing ICMP traffic.

D.The Ethernet cable is disconnected or the switch port is down.

AnswerD

Local ping works (loopback or local IP) but external fails, indicating a layer 1/2 issue.

Why this answer

The server can ping its own IP address (loopback or local interface), confirming that the network stack is functioning and the interface is up. However, the inability to ping the default gateway indicates a Layer 1 or Layer 2 issue, such as a disconnected Ethernet cable or a switch port that is administratively down, which prevents any traffic from leaving the local subnet.

Exam trap

The trap here is that candidates often assume a routing or firewall issue (options A or C) because they focus on Layer 3, but the ability to ping the local IP proves the stack is healthy, pointing instead to a physical or data-link layer problem that prevents any off-subnet communication.

How to eliminate wrong answers

Option A is wrong because a misconfigured default gateway in the routing table would still allow the server to send ARP requests for the gateway's IP; if the gateway is reachable at Layer 2, the ping would fail only if the gateway itself is unreachable, but the symptom here is a complete lack of connectivity to the gateway, which is more consistent with a physical or link-layer problem. Option B is wrong because the DNS resolver is used for name resolution, not for basic IP-level ping connectivity; the ping command uses an IP address, not a hostname, so DNS configuration is irrelevant to this issue. Option C is wrong because iptables firewall rules blocking outgoing ICMP traffic would prevent the server from sending echo requests to any destination, including its own IP; since the server can ping its own IP, the firewall is not blocking ICMP locally, and a rule blocking only outgoing traffic to the gateway would be an unusual and unlikely configuration.

Full explanation →

476

MCQmedium

A process is consuming excessive CPU and needs to be stopped immediately. The process ID is 4582. Which command should be used?

A.kill -9 4582

B.kill -1 4582

C.kill -STOP 4582

D.kill -15 4582

AnswerA

SIGKILL (9) immediately terminates the process.

Why this answer

kill -9 sends SIGKILL, which forcefully terminates the process immediately.

Full explanation →

477

MCQeasy

A Linux administrator writes a Bash script and includes the line `#!/bin/bash` at the top. What is the purpose of this line?

A.It sets the script to run in the background.

B.It enables debugging mode.

C.It specifies the interpreter to execute the script.

D.It defines a variable for the script.

AnswerC

The shebang indicates the path to the interpreter.

Why this answer

The shebang line tells the system which interpreter to use to execute the script. In this case, it specifies the Bash shell.

Full explanation →

478

Multi-Selectmedium

An administrator needs to verify DNS resolution for a web server. Which TWO commands can be used to query DNS A records for a given hostname? (Choose two.)

Select 2 answers

A.traceroute

B.nslookup

C.ping

D.dig

E.curl -I

AnswersB, D

nslookup queries DNS and can return A records.

Why this answer

dig and nslookup are standard DNS query tools. host is another option but not listed. curl uses HTTP, not direct DNS. ping uses DNS but does not show the record.

Full explanation →

479

Multi-Selectmedium

A systems administrator wants to monitor system performance in real time. Which TWO commands can be used to display live updating information about processes, CPU, and memory usage? (Select TWO.)

Select 2 answers

A.top

B.htop

C.ps aux

D.sar -u 1 5

E.vmstat 1

AnswersA, B

Real-time interactive process viewer.

Why this answer

The `top` command provides a real-time, dynamically updating view of system processes, CPU usage, and memory usage. It refreshes by default every few seconds, making it a standard tool for live performance monitoring. Similarly, `htop` is an enhanced interactive process viewer that offers a more user-friendly interface with color-coded, real-time updates on CPU, memory, and process information.

Exam trap

The trap here is that candidates often confuse static commands like `ps aux` with live monitoring tools, or they mistake `vmstat 1` for a process-level viewer when it actually provides aggregate system statistics without per-process details.

Full explanation →

480

MCQmedium

A system administrator is writing a Bash script that needs to iterate over a list of IP addresses stored in a file, one per line. Which loop construct should be used?

A.for i in $(cat ip_list.txt); do ... done

B.for ((i=0; i<$(wc -l < ip_list.txt); i++)); do ... done

C.while read line; do ... done < ip_list.txt

D.until IFS= read -r line; do ... done < ip_list.txt

AnswerA

Correct. `for i in $(cat ip_list.txt); do ... done` iterates over each line from the output of `cat`, treating it as a list item. This works well when the file contains one IP per line without spaces.

Why this answer

The for loop with command substitution ($(cat ip_list.txt)) iterates over each item in the file output, making it the appropriate construct for iterating over a list of IP addresses. Option B uses C-style syntax incorrectly and would not iterate over the file contents directly. Option C uses a while-read loop, which is intended for reading lines from input, not for iterating over a list of items from a file; therefore, it is not the loop construct asked for.

Option D uses an until loop that requires a conditional expression, not suitable for direct list iteration from a file.

Full explanation →

481

MCQmedium

A Linux system is experiencing high CPU load. The administrator runs 'top' and sees that the 'kworker' processes are consuming significant CPU time. What is the most likely cause?

A.A kernel module memory leak

B.A hardware interrupt storm caused by a failing disk controller

C.A user process stuck in an infinite loop

D.Insufficient memory causing swapping

AnswerB

kworker handles workqueues; hardware issues cause interrupts.

Why this answer

The 'kworker' processes in the 'top' output indicate kernel workqueue threads that handle deferred work. High CPU usage by kworker is typically caused by a hardware interrupt storm, often from a failing disk controller or other faulty hardware generating excessive interrupts that the kernel must service. This forces the workqueue to constantly process interrupt-related tasks, consuming significant CPU time.

Exam trap

The trap here is that candidates may confuse 'kworker' with a user-space process or attribute high CPU to a memory leak or swapping, but the key is recognizing that kworker is a kernel thread tied to hardware interrupt handling, making a hardware fault the most likely cause.

How to eliminate wrong answers

Option A is wrong because a kernel module memory leak would manifest as increasing memory consumption over time, not as high CPU usage by kworker processes; memory leaks primarily affect available memory and may trigger OOM, not CPU load. Option C is wrong because a user process stuck in an infinite loop would appear as a specific user-space process (e.g., 'myapp') consuming CPU in 'top', not as 'kworker' which is a kernel thread. Option D is wrong because insufficient memory causing swapping would show high 'si' and 'so' values in 'vmstat' and high I/O wait, not high CPU usage by kworker; swapping is a memory management issue, not a direct cause of kernel workqueue activity.

Full explanation →

482

Multi-Selecthard

A system administrator is configuring PAM to lock out users after 3 failed login attempts for 15 minutes. Which TWO PAM modules can be used together to achieve this? (Select TWO.)

Select 2 answers

A.pam_faillock.so

B.pam_tally2.so

C.pam_limits.so

D.pam_pwquality.so

E.pam_unix.so

AnswersA, E

pam_faillock can enforce lockout after failed attempts.

Why this answer

pam_faillock.so is the modern PAM module designed to track failed login attempts and enforce account lockout policies. It can be configured with parameters like `deny=3` to lock after three failures and `unlock_time=900` to set a 15-minute lockout duration. This module is the recommended replacement for the deprecated pam_tally2.so in current Linux distributions.

Exam trap

The trap here is that candidates often select pam_tally2.so (option B) because it was historically used for this purpose, but the exam expects knowledge of the modern, supported module pam_faillock.so, and they may also mistakenly think pam_unix.so alone handles lockout when it only performs standard Unix authentication.

Full explanation →

483

MCQhard

A server running a critical application needs to be rebooted. To ensure the application stops gracefully and data is not corrupted, which sequence of commands should the administrator use?

A.killall -9 application; reboot

B.reboot

C.systemctl stop application; sync; reboot

D.umount -a; reboot

AnswerC

Stops service gracefully, syncs disks, then reboots.

Why this answer

It first uses systemctl to send a SIGTERM to the application, allowing it to perform a graceful shutdown and flush its data. The sync command then forces any pending disk writes to complete, ensuring filesystem consistency before the reboot. This sequence minimizes the risk of data corruption by giving the application and kernel time to finalize all I/O operations.

Exam trap

CompTIA often tests the misconception that a simple reboot or killall -9 is sufficient for critical applications, but the trap here is that candidates overlook the need for a graceful stop and filesystem sync to prevent data corruption.

How to eliminate wrong answers

Option A is wrong because killall -9 sends SIGKILL, which immediately terminates the application without allowing it to clean up resources or flush data, potentially causing corruption. Option B is wrong because a plain reboot command does not explicitly stop the application or sync the filesystem, relying on the system's shutdown scripts which may not handle the critical application gracefully. Option D is wrong because umount -a attempts to unmount all filesystems, which will fail if any filesystem is busy (e.g., the application has open files), and it does not stop the application first, leading to forced unmounts or data loss.

Full explanation →

484

MCQeasy

A security audit reveals a misconfiguration. Which file has insecure permissions that could allow unauthorized users to read password hashes?

A.Both files are misconfigured

B./etc/shadow

C.Neither file has a misconfiguration

D./etc/passwd

AnswerB

Permissions 664 allow read by group and others, which is insecure; should be 600.

Why this answer

The /etc/shadow file stores password hashes and should be readable only by the root user (typically permissions 640 or 600). If its permissions are too permissive (e.g., world-readable), any local user could read the hashes and attempt offline cracking. This is the misconfiguration the audit would flag.

Exam trap

CompTIA often tests the misconception that /etc/passwd contains password hashes (as it did in older Unix systems), but modern Linux distributions use shadow passwords, so the hashes are exclusively in /etc/shadow.

How to eliminate wrong answers

Option A is wrong because only one file (the shadow file) is the typical target for insecure permissions on password hashes; both files being misconfigured is not the standard finding. Option C is wrong because a misconfiguration does exist in the shadow file, so 'neither file has a misconfiguration' is false. Option D is wrong because /etc/passwd traditionally stores user account information (UID, GID, home directory, shell) but not password hashes (which are stored in /etc/shadow on modern Linux systems using shadow passwords); even if /etc/passwd is world-readable by design, it does not contain the hashes, so its permissions are not the direct security concern for reading password hashes.

Full explanation →

485

MCQeasy

An administrator needs to schedule a system maintenance task to run at 3 AM every Sunday. Which cron expression should be used?

A.0 3 * * 7

B.0 3 * * 0

C.0 3 * * 1

D.* 3 * * 0

AnswerB

Correct: minute 0, hour 3, every day, every month, Sunday.

Why this answer

In cron, Sunday can be specified as either 0 or 7. The expression '0 3 * * 0' means the task runs at minute 0, hour 3 (3 AM), every day of the month (*), every month (*), and only on Sunday (0). This matches the requirement exactly.

Exam trap

The trap here is that candidates may remember that Sunday can be 0 or 7 and choose Option A, not realizing that the XK0-005 exam expects the standard POSIX value of 0 for Sunday, and that 7 is non-standard or implementation-specific.

How to eliminate wrong answers

Option A is wrong because while 7 also represents Sunday in some cron implementations, the standard POSIX cron and most Linux distributions (including those tested in XK0-005) treat 7 as invalid or undefined; the correct numeric value for Sunday is 0. Option C is wrong because 1 represents Monday, not Sunday. Option D is wrong because the minute field is set to '*' instead of '0', which would cause the task to run every minute from 3:00 AM to 3:59 AM on Sundays, not just at 3:00 AM.

Full explanation →

486

Multi-Selectmedium

A technician wants to capture network traffic to analyze a web server issue. Using tcpdump, which THREE options are useful for writing the capture to a file and avoiding name resolution? (Choose three.)

Select 3 answers

A.-n

B.-w capture.pcap

C.-i eth0

D.-c 100

E.-v

AnswersA, B, C

-n disables name resolution.

Why this answer

-w writes to file, -n avoids name resolution, and -i specifies interface.

Full explanation →

487

MCQmedium

A developer is writing a Dockerfile. The application requires a configuration file that should be copied from the build context and the container should expose port 8080. Which combination of Dockerfile instructions is correct?

A.COPY config.txt /app/ and EXPOSE 8080

B.ADD config.txt /app/ and WORKDIR 8080

C.ADD config.txt /app/ and RUN expose 8080

D.COPY config.txt /app/ and CMD 8080

AnswerA

Correct. COPY copies the file, EXPOSE documents the port.

Why this answer

COPY adds files from the build context, and EXPOSE documents the port. Other instructions serve different purposes.

Full explanation →

488

MCQmedium

An administrator wants to ensure a service starts automatically at boot on a systemd-based system. Which command should be used?

A.systemctl enable service

B.systemctl start service

C.systemctl status service

D.systemctl reload service

AnswerA

Enables the service to start at boot.

Why this answer

systemctl enable sets the service to start automatically at boot.

Full explanation →

489

MCQmedium

Refer to the exhibit. An administrator is troubleshooting an issue where services cannot write log files. Based on the output, which filesystem is most likely the cause?

A./dev/sda3 (/home)

B.Swap partition

C./dev/sda2 (/var)

D./dev/sda1 (/)

AnswerD

Root at 95% is nearly full.

Why this answer

The output shows that the root filesystem /dev/sda1 mounted on / is at 95% usage. Since log files are typically written under /var/log, which resides on the root partition unless /var is a separate mount point, a nearly full root filesystem prevents services from writing log files. The correct answer is D because the root filesystem is nearly full, causing the write failures.

Exam trap

CompTIA often tests the misconception that log files always reside on a separate /var partition, but in many default configurations, /var is part of the root filesystem, so a full root partition directly impacts log writes.

How to eliminate wrong answers

Option A is wrong because /dev/sda3 (/home) is used for user home directories, not for system log files, and its usage is not indicated as full. Option B is wrong because the swap partition is used for virtual memory, not for storing log files, and swap usage does not affect filesystem write capacity. Option C is wrong because /dev/sda2 (/var) is a separate partition that is not shown as full in the exhibit; the issue is with the root partition, not /var.

Full explanation →

490

MCQhard

An administrator needs to ensure that a custom script /usr/local/bin/backup.sh runs every day at 2:00 AM and logs output to /var/log/backup.log. How should this be configured using systemd?

A.Use anacron with a delay of 0 and a period of 1 day.

B.Add a cron job with '0 2 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1'.

C.Create a systemd timer unit that activates a service unit, with OnCalendar=daily and the desired time.

D.Place the script in /etc/cron.daily/ and set the time with the 'START_HOURS_RANGE' variable.

AnswerC

Systemd timers allow precise scheduling and integrate with journald for logging.

Why this answer

Systemd timer units are the modern, recommended method for scheduling recurring tasks on Linux systems that use systemd. By creating a timer unit with `OnCalendar=daily` and specifying the desired time (e.g., `02:00:00`), the associated service unit will execute `/usr/local/bin/backup.sh` at 2:00 AM daily. The service unit can also redirect output to `/var/log/backup.log` using standard output/error directives, ensuring logging is handled natively within the systemd framework.

Exam trap

The trap here is that candidates often default to cron (Option B) because it is familiar, but the question explicitly requires a systemd-based solution, testing knowledge of systemd timer units as the correct modern approach.

How to eliminate wrong answers

Option A is wrong because anacron is designed for systems that may not run continuously (e.g., laptops) and does not support precise time-of-day scheduling like 2:00 AM; it only guarantees execution within a day with a delay. Option B is wrong because while a cron job with the given syntax would work, the question explicitly asks for a systemd-based configuration, not cron; cron is a separate init system and not part of systemd. Option D is wrong because placing the script in `/etc/cron.daily/` runs it once per day via cron, but the `START_HOURS_RANGE` variable only controls the range of hours during which cron.daily jobs can start, not a specific time like 2:00 AM; it cannot guarantee execution at exactly 2:00 AM.

Full explanation →

491

MCQeasy

A system fails to boot after installing a new SATA disk. The BIOS recognizes the disk. What is the most likely cause?

A.GRUB configuration is corrupted

B.Boot order is incorrect

C.The new disk is not formatted

D.The new disk is not partitioned

AnswerB

The system might try to boot from the new disk, which has no bootloader.

Why this answer

The most likely cause is an incorrect boot order because the BIOS recognizes the new SATA disk but the system still fails to boot. When a new disk is installed, the BIOS may default to booting from it if it appears earlier in the boot sequence than the original boot device, and if the new disk lacks a bootable operating system, the system will hang or fail to boot. This is a common scenario where the BIOS sees the disk but the boot priority is misconfigured, not a corruption of GRUB or a lack of formatting/partitioning.

Exam trap

The trap here is that candidates often assume a new disk must be partitioned and formatted before it can cause boot issues, but the BIOS boot order is independent of filesystem state, and a blank disk can still be selected as the first boot device, leading to a 'No bootable device' error.

How to eliminate wrong answers

Option A is wrong because a corrupted GRUB configuration would typically produce a specific error message (e.g., 'GRUB rescue' or 'file not found') and would not be caused simply by installing a new disk; the BIOS would still attempt to boot from the original disk. Option C is wrong because a disk does not need to be formatted to be recognized by the BIOS or to affect boot order; formatting is a filesystem operation that occurs after partitioning and does not prevent the BIOS from listing the disk. Option D is wrong because an unpartitioned disk is still recognized by the BIOS and can be selected in the boot order; the lack of partitions does not cause a boot failure unless the system tries to boot from that disk, which is a boot order issue, not a partitioning issue.

Full explanation →

492

MCQhard

A DevOps engineer is writing a Bash script that iterates over all items in an array. The array is declared as 'fruits=("apple" "banana" "cherry")'. Which loop correctly iterates over each element?

A.for fruit in "${fruits[@]}"; do ... done

B.for (i=0; i<${#fruits[@]}; i++); do ... done

C.for fruit in ${fruits[*]}; do ... done

D.for fruit in $fruits; do ... done

AnswerA

Properly iterates over each array element as separate words, even if they contain spaces.

Why this answer

To iterate over array elements, use "${fruits[@]}" with quotes. The @ expands to all elements.

Full explanation →

493

Multi-Selectmedium

An administrator wants to harden SSH access by implementing the following: disallow root login, disable password authentication, and limit the number of authentication attempts. Which three configuration directives should be set in /etc/ssh/sshd_config? (Choose THREE.)

Select 3 answers

A.PermitRootLogin no

B.Port 22

C.PermitEmptyPasswords no

D.PasswordAuthentication no

E.MaxAuthTries 3

AnswersA, D, E

Disallows root login via SSH.

Why this answer

PermitRootLogin no, PasswordAuthentication no, and MaxAuthTries limit attempts.

Full explanation →

494

MCQmedium

An administrator notices repeated failed login attempts in /var/log/secure. The company policy requires account lockout after 5 failed attempts within 15 minutes. Which PAM module and configuration can enforce this?

A.pam_unix.so with remember=5

B.pam_pwquality.so with minlen=5

C.pam_limits.so with maxlogins=5

D.pam_faillock.so with deny=5 unlock_time=900

AnswerD

This configuration locks after 5 attempts and unlocks after 15 minutes.

Why this answer

Pam_faillock.so is the PAM module specifically designed to track failed login attempts and enforce account lockout policies. The `deny=5` parameter sets the threshold to 5 failures, and `unlock_time=900` sets the lockout duration to 900 seconds (15 minutes), matching the policy requirement exactly.

Exam trap

The trap here is confusing password policy modules (pam_pwquality.so, pam_unix.so) or session limits (pam_limits.so) with the dedicated account lockout module pam_faillock.so, leading candidates to select options that address different security controls.

How to eliminate wrong answers

Option A is wrong because pam_unix.so with `remember=5` controls password history (preventing reuse of the last 5 passwords), not account lockout after failed logins. Option B is wrong because pam_pwquality.so with `minlen=5` enforces password complexity and minimum length, not failed login attempt tracking. Option C is wrong because pam_limits.so with `maxlogins=5` limits the maximum number of concurrent login sessions for a user, not the number of failed attempts before lockout.

Full explanation →

495

MCQeasy

The administrator wants to block the IP address shown in the exhibit. Which command should be used?

A.fail2ban

B.echo '192.168.1.100' >> /etc/hosts.deny

C.iptables -A INPUT -s 192.168.1.100 -j DROP

D.firewall-cmd --add-source=192.168.1.100 --permanent

AnswerC

Correct: Drops all packets from that IP.

Why this answer

`iptables -A INPUT -s 192.168.1.100 -j DROP` appends a rule to the INPUT chain that drops all incoming packets from the source IP 192.168.1.100. This is the standard Linux firewall command for blocking traffic at the network layer using netfilter, and it works immediately without requiring a service restart.

Exam trap

The trap here is that candidates confuse `hosts.deny` with a network-level firewall, not realizing it only controls access to specific services using TCP wrappers and requires a daemon:client format, while `iptables` operates at the kernel level on all IP traffic.

How to eliminate wrong answers

Option A is wrong because `fail2ban` is a log-parsing intrusion prevention tool that dynamically blocks IPs based on repeated authentication failures, not a direct command to statically block a single IP address. Option B is wrong because `/etc/hosts.deny` is used by the TCP wrappers library (hosts_access) to control access to services compiled with libwrap, not to block IP traffic at the network layer; it only affects specific daemons like sshd or vsftpd, and the syntax requires a daemon name (e.g., `ALL: 192.168.1.100`). Option D is wrong because `firewall-cmd --add-source=192.168.1.100 --permanent` adds a source address to the default zone, which typically allows traffic from that source rather than blocking it; to block, you would need to use `--add-rich-rule` with a `reject` or `drop` action.

Full explanation →

496

Multi-Selectmedium

In a Bash script, which THREE of the following are valid ways to define a function? (Select THREE.)

Select 3 answers

A.function myfunc() { commands; }

B.myfunc = () { commands; }

C.function myfunc { commands; }

D.def myfunc { commands; }

E.myfunc() { commands; }

AnswersA, C, E

Combined syntax, also valid in Bash.

Why this answer

The correct options are A, C, and E. In Bash, a function can be defined using any of these three syntaxes: 'function name { commands; }' (option C), 'name() { commands; }' (option E), or 'function name() { commands; }' (option A). Option B is invalid because it uses an equals sign after the function name, which is not part of any valid Bash function definition.

Option D is invalid because 'def' is not a Bash keyword; it is used in Python and other languages, but not in Bash.

Full explanation →

497

MCQmedium

A cloud engineer needs to automate the deployment of a new virtual machine with a specific configuration using Ansible. Which file format is typically used for Ansible playbooks?

A.JSON

B.YAML

C.XML

D.INI

AnswerB

Standard for playbooks.

Why this answer

Ansible playbooks are written in YAML (YAML Ain't Markup Language) because it is human-readable, supports complex data structures like lists and dictionaries, and is designed for configuration management. YAML's indentation-based syntax aligns with Ansible's declarative approach, allowing tasks, variables, and handlers to be defined cleanly without the overhead of brackets or tags.

Exam trap

The trap here is that candidates confuse the file format for playbooks (YAML) with other Ansible file types, such as JSON for dynamic inventory or INI for static inventory, leading them to select a technically valid but incorrect format for the specific question context.

How to eliminate wrong answers

Option A is wrong because JSON, while valid for Ansible inventory files or dynamic inventory scripts, is not the standard format for playbooks; playbooks rely on YAML's readability and support for comments. Option C is wrong because XML is verbose, uses angle-bracket tags, and is not natively supported by Ansible for playbook definitions, making it impractical for automation workflows. Option D is wrong because INI files are used for Ansible inventory configuration (e.g., listing hosts and groups), not for defining the ordered tasks and logic within a playbook.

Full explanation →

498

MCQeasy

A user reports that their system is unable to boot after a recent kernel update. The system displays a 'kernel panic' message. Which of the following is the MOST efficient way to boot into a previous kernel version?

A.Select an older kernel from the GRUB menu

B.Use the systemd rescue mode

C.Reinstall the operating system

D.Boot from a live CD and chroot

AnswerA

GRUB typically lists older kernel entries, allowing quick selection of a working kernel.

Why this answer

The GRUB bootloader stores multiple kernel versions after an update, allowing you to select a previous kernel from its menu at boot time. Choosing an older kernel bypasses the faulty new kernel without requiring additional tools or recovery media, making it the most efficient method to resolve a kernel panic caused by a recent update.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing systemd rescue mode or chroot, not realizing that GRUB's menu provides the simplest and fastest way to revert to a working kernel without any additional recovery steps.

How to eliminate wrong answers

Option B is wrong because systemd rescue mode (or emergency mode) boots into a minimal environment but still uses the default (new) kernel, which will likely trigger the same kernel panic. Option C is wrong because reinstalling the operating system is a drastic, time-consuming step that is unnecessary when a previous kernel is available in GRUB. Option D is wrong because booting from a live CD and chrooting is a valid recovery method, but it is far less efficient than simply selecting an older kernel from the GRUB menu, as it requires external media and manual chroot steps.

Full explanation →

499

MCQmedium

An administrator wants to find all files in /var/log that have been modified within the last 2 days and have a .log extension. Which command should be used?

A.find /var/log -mtime 2 -name *.log

B.find /var/log -type f -mtime -2 -name "*.log"

C.locate --mtime -2 *.log /var/log

D.ls -la /var/log | grep "\.log$" | head -20

AnswerB

This correctly finds files modified within the last 2 days with .log extension.

Why this answer

The find command with -mtime -2 finds files modified less than 2 days ago, and -name '*.log' matches the extension.

Full explanation →

500

MCQeasy

Which command is used to create a symbolic link named 'link' pointing to the file 'original'?

A.symlink original link

B.ln -s link original

C.ln original link

D.ln -s original link

AnswerD

This creates a symbolic link from link to original.

Why this answer

ln -s creates a symbolic link.

Full explanation →

501

MCQhard

A SysAdmin is investigating a server that has become unresponsive. The server was working fine, but after a recent update, it hangs during boot, showing 'A start job is running for /dev/mapper/rootvg-rootlv (xxs / no limit)'. This indicates a filesystem check is taking long. What is the most efficient way to skip the fsck and boot quickly?

A.At boot, press Ctrl+D to continue.

B.Boot into single-user mode and run fsck.

C.Use the kernel parameter 'fsck.mode=skip'.

D.Edit /etc/fstab to set the sixth field to 0 for the root filesystem.

AnswerC

This parameter temporarily skips all filesystem checks for the current boot.

Why this answer

The kernel parameter 'fsck.mode=skip' instructs systemd to skip all filesystem checks during boot, allowing the server to bypass the stuck fsck job and start quickly. This is the most efficient method for a one-time skip without permanently altering configuration files.

Exam trap

The trap here is that candidates may confuse the permanent /etc/fstab sixth field (which controls fsck frequency) with the temporary kernel parameter, or incorrectly think that Ctrl+D or single-user mode will skip the check, when in fact they do not bypass the stuck job.

How to eliminate wrong answers

Option A is wrong because pressing Ctrl+D at the 'A start job is running' prompt does not skip the fsck; it typically sends an EOF signal that may abort the current job or continue waiting, but does not reliably bypass the filesystem check. Option B is wrong because booting into single-user mode and running fsck would perform the check, which is the opposite of skipping it and would not achieve a quick boot. Option D is wrong because editing /etc/fstab to set the sixth field to 0 disables fsck for that filesystem permanently, which is not the most efficient one-time skip and may mask future filesystem issues.

Full explanation →

502

Multi-Selecthard

A Linux engineer is troubleshooting a server that fails to boot. The server displays a message indicating 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. Which TWO actions should the engineer take to resolve this issue? (Choose TWO.)

Select 2 answers

A.Reinstall GRUB to the Master Boot Record

B.Boot from a rescue disk and rebuild the initramfs with the necessary filesystem modules

C.Run fsck on the root partition to check for filesystem corruption

D.Check the kernel command line in the bootloader configuration for the correct root= parameter

E.Disable SELinux by adding selinux=0 to the kernel command line

AnswersB, D

Rebuilding initramfs includes required modules for root filesystem access.

Why this answer

The error 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate or mount the root filesystem. Option B is correct because rebuilding the initramfs from a rescue disk ensures the necessary filesystem drivers (e.g., ext4, xfs) are included, which may have been missing or corrupted. Option D is correct because the root= parameter in the bootloader configuration (e.g., GRUB) tells the kernel which device/partition to mount as root; a typo or incorrect value (e.g., wrong UUID or device name) will cause this exact panic.

Exam trap

The trap here is that candidates confuse a kernel panic about root filesystem mounting with a bootloader or filesystem corruption issue, leading them to choose GRUB reinstallation (A) or fsck (C) instead of addressing the initramfs or kernel command line.

Full explanation →

503

MCQmedium

A system administrator notices that a web server is running but users cannot connect to port 443. Which ss command will show if the server is listening on that port?

A.ss -s

B.ss -tlnp

C.ss -tuln

D.ss -tan

AnswerB

Shows TCP listening sockets with process info.

Why this answer

ss -tlnp shows listening TCP sockets with numeric ports and process info. -t for TCP, -l listening, -n numeric, -p process.

Full explanation →

504

Drag & Dropmedium

Drag and drop the steps to troubleshoot a network connectivity issue using common commands in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Troubleshooting network connectivity should follow a logical progression from local to remote: first verify your own IP address and subnet mask, then check the default gateway, then test DNS resolution, and finally test connectivity to a remote host. This systematic approach helps isolate the root cause efficiently.

Full explanation →

505

MCQeasy

Which of the following Bash variable expansions will result in the string "Hello World"?

A.${GREETING:+World} when GREETING=Hello

B.${GREETING:-World} when GREETING=Hello

C.${GREETING:-'Hello World'} when GREETING is unset

D.${GREETING:=World} when GREETING is unset

AnswerC

Since GREETING is unset, the default value 'Hello World' is used.

Why this answer

${var:-default} expands to the value of var if var is set and not null; otherwise, it expands to default. In option C, GREETING is unset, so ${GREETING:-'Hello World'} expands to 'Hello World'. Option A: ${GREETING:+World} with GREETING=Hello expands to 'World' because + uses alternate value when var is set.

Option B: ${GREETING:-World} with GREETING=Hello expands to 'Hello' because var is set. Option D: ${GREETING:=World} with GREETING unset assigns 'World' to GREETING and expands to 'World', not 'Hello World'. Therefore, only option C yields 'Hello World'.

Full explanation →

506

Multi-Selecteasy

Which THREE of the following are valid systemd unit types?

Select 3 answers

A.timer

B.socket

C.system

D.cron

E.service

AnswersA, B, E

Valid unit type.

Why this answer

A is correct because `timer` is a valid systemd unit type used to schedule and trigger other units (typically services) based on time events, similar to cron but integrated with systemd. Timers can be monotonic (relative to system events) or real-time (calendar-based), and they are defined in `.timer` files.

Exam trap

CompTIA often tests the distinction between systemd-native unit types and external scheduling tools like cron, so candidates may mistakenly think `cron` is a systemd unit type because both handle scheduling, but systemd uses `timer` units instead.

Full explanation →

507

MCQhard

A Linux administrator is responsible for a critical application that runs as a systemd service on a server. The application occasionally hangs, and the administrator wants to automate the restart if the service becomes unresponsive. The administrator writes a Bash script that checks if the service is active and responsive by pinging a local health endpoint. If the health check fails three consecutive times, the script restarts the service. The script is intended to run every minute via a cron job. However, after implementing the cron job, the service is restarted even when it is functioning correctly, causing unnecessary downtime. The administrator reviews the script and finds the following logic: #!/bin/bash SERVICE="myapp" COUNT_FILE="/tmp/${SERVICE}_failcount" if curl -f http://localhost:8080/health; then echo 0 > "$COUNT_FILE" else FAILS=$(cat "$COUNT_FILE" 2>/dev/null || echo 0) FAILS=$((FAILS + 1)) echo "$FAILS" > "$COUNT_FILE" if [ "$FAILS" -ge 3 ]; then systemctl restart "$SERVICE" echo 0 > "$COUNT_FILE" fi fi What is the most likely cause of the false restarts?

A.The count file is not being written because the script lacks write permissions to /tmp.

B.Multiple instances of the script are running concurrently due to cron timing, causing a race condition on the count file.

C.The script does not reset the count file after a successful health check.

D.The script does not handle the case where the count file does not exist on the first failure.

AnswerB

Without file locking, concurrent runs can overwrite each other's counts, leading to inaccurate failure counts and false restarts.

Why this answer

The cron job runs the script every minute, but if the health check takes longer than a minute (e.g., due to network latency or a slow endpoint), multiple instances of the script can overlap. Each instance reads, increments, and writes the count file independently, causing a race condition where the fail count can be artificially inflated, leading to a false restart even when the service is healthy.

Exam trap

CompTIA often tests the misconception that a missing file or permission error is the root cause, when in reality the issue is a race condition from overlapping cron job executions.

How to eliminate wrong answers

Option A is wrong because the script writes to /tmp, which is world-writable by default, and the script runs as root (or a user with sufficient privileges) via cron, so permission issues are unlikely; if write permissions were missing, the script would fail entirely, not cause false restarts. Option C is wrong because the script does reset the count file to 0 after a successful health check (the `echo 0 > "$COUNT_FILE"` line), so this is not the cause of false restarts. Option D is wrong because the script handles a missing count file on the first failure by using `cat "$COUNT_FILE" 2>/dev/null || echo 0`, which defaults to 0 if the file does not exist, so this is not a bug.

Full explanation →

508

MCQmedium

A security policy requires that all SUID files be identified and reviewed. Which command can recursively find SUID files?

A.find / -type f -perm 0777

B.find / -perm /4000

C.ls -lR | grep '^...s'

D.find / -perm -2000

AnswerB

This finds files with the SUID bit set (4000).

Why this answer

'find / -perm /4000' searches for files with the SUID bit set (the / before the permission mask indicates that any of the bits in 4000 must be set). Option A uses permission 0777, which finds world-writable files, not SUID. Option C uses 'ls -lR | grep' to locate files with an 's' in the owner execute position, which does identify SUID files, but parsing 'ls' output is fragile and not the recommended method; the question asks for a command, and while it can work, it is less reliable than 'find'.

Option D uses '-perm -2000' which matches files with the SGID bit set, not SUID.

Full explanation →

509

MCQeasy

Based on the exhibit, how often does the healthcheck.sh script run?

A.Every 5 days

B.Every 5 minutes

C.Every 5 hours

D.Every 5 seconds

AnswerB

Correct interpretation.

Why this answer

The cron expression `*/5 * * * *` in the crontab file means the script runs every 5 minutes. The `*/5` in the minute field triggers execution every 5 minutes, while the asterisks in the hour, day, month, and weekday fields mean every hour, every day, every month, and every day of the week, respectively.

Exam trap

CompTIA often tests the distinction between cron fields: candidates confuse the minute field with the hour field, thinking `*/5` means every 5 hours instead of every 5 minutes, especially when the context is a health check that might logically run less frequently.

How to eliminate wrong answers

Option A is wrong because a cron expression with `*/5` in the minute field does not represent days; a 5-day interval would require `*/5` in the day-of-month field (e.g., `0 0 */5 * *`). Option C is wrong because every 5 hours would use `0 */5 * * *` (minute set to 0, hour field with `*/5`). Option D is wrong because cron does not support sub-minute intervals; the smallest unit is one minute, so every 5 seconds is impossible with standard cron.

Full explanation →

510

Multi-Selecteasy

A web server is experiencing high load. The administrator wants to identify the processes consuming the most CPU. Which TWO commands can be used to display real-time process CPU usage?

Select 2 answers

A.lsof

B.iostat

C.vmstat

D.top

E.ps aux --sort=-%cpu

AnswersD, E

Correct: Real-time process viewer with CPU usage.

Why this answer

(top) is correct because it provides a real-time, dynamic view of system processes, including CPU usage, and updates continuously by default. Option E (ps aux --sort=-%cpu) is also correct because it lists all processes sorted by CPU usage in descending order, though it is a snapshot rather than continuous; however, the question asks for commands that can be used to display real-time process CPU usage, and ps with the --sort flag can be run repeatedly to approximate real-time monitoring.

Exam trap

CompTIA often tests the distinction between system-wide monitoring tools (iostat, vmstat) and per-process tools (top, ps), leading candidates to mistakenly choose iostat or vmstat when the question explicitly asks for processes consuming the most CPU.

Full explanation →

511

Matchingmedium

Match each Linux command to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

List block devices

List open files

Manage partition tables

Inform OS of partition changes

Display block device attributes

Why these pairings

The correct matches are: df shows disk space, du estimates file space, fdisk manages partitions, mkfs creates filesystems. Common confusions involve mixing df/du and mount/fsck with wrong functions.

Full explanation →

512

MCQhard

A server is experiencing intermittent high load. The administrator suspects a memory leak in a service. Which sysfs file should the administrator monitor to track memory usage per cgroup?

A./sys/fs/cgroup/memory/memory.limit_in_bytes

B./proc/meminfo

C./sys/fs/cgroup/memory/memory.usage_in_bytes

D./sys/fs/cgroup/memory/memory.stat

AnswerC

Directly shows the current memory usage in bytes for the cgroup.

Why this answer

Memory.usage_in_bytes in the cgroup v1 memory hierarchy shows the current memory consumption of processes within a specific cgroup, making it the direct metric to monitor for a suspected memory leak in a service. Unlike system-wide files, this per-cgroup file reflects only the memory used by the service's control group, allowing precise tracking of growth over time.

Exam trap

CompTIA often tests the distinction between 'limit' and 'usage' files, trapping candidates who confuse the configuration file (memory.limit_in_bytes) with the monitoring file (memory.usage_in_bytes).

How to eliminate wrong answers

Option A is wrong because memory.limit_in_bytes sets the maximum memory limit for a cgroup, not the current usage, so it cannot show a leak. Option B is wrong because /proc/meminfo provides system-wide memory statistics, not per-cgroup data, and cannot isolate a specific service's memory consumption. Option D is wrong because memory.stat contains detailed breakdowns (e.g., cache, RSS, swap) but not a single current usage value; it requires parsing multiple fields and is less direct for tracking a leak.

Full explanation →

513

MCQeasy

Which command will show the current running processes in real time?

A.top

B.pstree

C.ps aux

D.htop

AnswerA

top continuously updates the list of processes.

Why this answer

The `top` command is the standard Linux utility for displaying a dynamic, real-time view of running processes, including CPU and memory usage. It updates the display at a configurable interval (default 3 seconds) and provides an interactive interface for sorting and managing processes. This makes it the correct choice for showing current running processes in real time.

Exam trap

The trap here is that candidates may confuse `htop` as the correct answer because it is more visually appealing and feature-rich, but the exam expects the standard, universally available command `top`.

How to eliminate wrong answers

Option B is wrong because `pstree` displays running processes as a tree hierarchy but shows a static snapshot, not real-time updates. Option C is wrong because `ps aux` lists all processes with detailed information but outputs a single static snapshot; it does not refresh automatically. Option D is wrong because `htop` is indeed a real-time process viewer, but it is not installed by default on many minimal Linux distributions, whereas `top` is universally available and the standard command expected for this purpose.

Full explanation →

514

MCQmedium

A Linux technician is configuring a firewall with firewalld. The organization requires that SSH services be available only on the internal network zone (10.0.0.0/8). Which command should be used to add this rule permanently?

A.firewall-cmd --zone=internal --add-port=22/tcp --add-source=10.0.0.0/8 --permanent

B.firewall-cmd --zone=public --add-service=ssh --add-source=10.0.0.0/8 --permanent

C.firewall-cmd --zone=internal --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 service name=ssh accept' --permanent

D.firewall-cmd --zone=internal --add-service=ssh --add-source=10.0.0.0/8 --permanent

AnswerD

This adds both source and service to the zone, making SSH available only from internal network.

Why this answer

Option D is correct because it uses --add-service=ssh to allow the SSH service and --add-source to restrict the source to 10.0.0.0/8, making the rule permanent. This follows best practices by leveraging service definitions. Option A opens port 22 directly, which works but is less precise and not service-aware.

Option C uses a rich rule, which is overly complex for this straightforward requirement. Option B targets the public zone, which is incorrect.

Full explanation →

515

MCQmedium

A systems administrator notices that users can successfully authenticate via SSH using their password, but cannot log in via the console. The /etc/securetty file exists and contains only the default entries. Which configuration change is most likely to resolve the issue?

A.Add 'console' to the /etc/securetty file

B.Add the denyhosts service to block non-console logins

C.Set PermitRootLogin yes in /etc/ssh/sshd_config

D.Set SELinux to permissive mode

AnswerA

/etc/securetty lists TTY devices where root is allowed to log in; adding console allows root login via the physical console.

Why this answer

The /etc/securetty file lists TTY devices from which root is allowed to log in via console or terminal. By default, it often includes entries like 'tty1' through 'tty6' but not 'console'. Adding 'console' to this file permits root login from the system console, resolving the issue where console authentication fails while SSH (which bypasses /etc/securetty) succeeds.

Exam trap

The trap here is that candidates may confuse console login restrictions with SSH configuration (PermitRootLogin) or security hardening tools (denyhosts, SELinux), rather than recognizing that /etc/securetty specifically governs which TTYs allow root login via console or terminal.

How to eliminate wrong answers

Option B is wrong because denyhosts is a service that blocks SSH brute-force attacks by monitoring failed login attempts, not a mechanism to control console access. Option C is wrong because PermitRootLogin yes in /etc/ssh/sshd_config controls SSH root login only, not console login, and the issue is about console access, not SSH. Option D is wrong because setting SELinux to permissive mode disables SELinux enforcement entirely, which is an overly broad and insecure change that does not specifically address the /etc/securetty restriction on console logins.

Full explanation →

516

MCQeasy

A shared directory requires that any new files created within it are automatically writable by the group. What umask value should be set for users working in this directory?

A.0777

B.0027

C.0002

D.0022

AnswerC

This umask subtracts 0002, giving group write permission on new files.

Why this answer

(0002) is correct because the umask subtracts permissions from the default 0666 for files. A umask of 0002 removes the 'write' permission for others (o-w), leaving the group with read/write (rw) and the owner with read/write (rw). This ensures new files are group-writable, as required for a shared directory.

Exam trap

The trap here is that candidates often confuse umask with the final permission value, mistakenly thinking a higher umask like 0022 is safer, but it actually removes group write access, which is the opposite of what the question requires.

How to eliminate wrong answers

Option A (0777) is wrong because it would remove all permissions from the default, resulting in files with no permissions (000), which is not useful. Option B (0027) is wrong because it removes write permission from the group (g-w), making new files not group-writable, which contradicts the requirement. Option D (0022) is wrong because it removes write permission from the group (g-w) as well, leaving files with owner write only, not group-writable.

Full explanation →

517

MCQhard

Your organization uses Ansible for configuration management across 500 servers. The management server is a Linux workstation. You have written a playbook to deploy a new monitoring agent. The playbook works on all test machines but fails on production machines at the 'Gather Facts' stage with the error: 'fatal: [server1]: FAILED! => {"msg": "Timed out waiting for privilege escalation prompt: become method 'sudo' requires a password" }'. All production servers have the same sudoers configuration. You have confirmed that the user 'ansible' has passwordless sudo configured correctly. What is the most likely cause?

A.The production servers have a different SSH key

B.The SSH timeout is too low

C.The ansible_become_password is not set in the inventory

D.The become_user is set incorrectly

AnswerC

Without ansible_become_password, Ansible waits for a password prompt; setting it to empty acknowledges passwordless sudo.

Why this answer

The error indicates that Ansible's privilege escalation (sudo) is prompting for a password, even though the 'ansible' user has passwordless sudo configured. This typically occurs when the 'ansible_become_password' variable is not set or is empty in the inventory, causing Ansible to wait for a password prompt that never comes. Since the playbook works on test machines, the difference is likely that the inventory for production lacks the required 'ansible_become_password' or 'ansible_become' settings, or the variable is not being passed correctly.

Exam trap

The trap here is that candidates assume passwordless sudo means no 'become_password' is needed, but Ansible still requires the variable to be explicitly set (even to an empty string) or the 'become' method to be configured correctly to avoid waiting for a prompt.

How to eliminate wrong answers

Option A is wrong because a different SSH key would cause an authentication failure at the SSH connection stage, not a privilege escalation timeout after successful login. Option B is wrong because an SSH timeout would produce a 'Connection timed out' error, not a 'Timed out waiting for privilege escalation prompt' error. Option D is wrong because setting 'become_user' incorrectly would typically result in a 'user does not exist' or 'permission denied' error, not a timeout waiting for a sudo password prompt.

Full explanation →

518

MCQmedium

An administrator wants to grant a specific user, 'jdoe', read and write access to a file that is owned by root:root with permissions 640. The administrator does not want to change the file's owner or group. Which approach should be used?

A.Use setfacl -m u:jdoe:rw file

B.Change file owner to jdoe

C.Use chmod o+rw file

D.Add jdoe to the root group

AnswerA

Correct: ACL entry for user jdoe grants read and write without altering standard permissions.

Why this answer

ACLs allow granting permissions to a specific user without changing the file's owner or group. setfacl -m u:jdoe:rw file sets read-write ACL for user jdoe.

Full explanation →

519

MCQmedium

A system administrator notices that the server is performing poorly. Running 'vmstat 1 5' shows high 'wa' values. Which subsystem is most likely experiencing a bottleneck?

A.Memory

B.Disk I/O

C.Network

D.CPU

AnswerB

Correct. High wa means the CPU is waiting for disk I/O.

Why this answer

wa stands for I/O wait time, indicating the CPU is waiting for disk I/O. High wa suggests a disk bottleneck.

Full explanation →

520

Multi-Selecteasy

Which TWO characteristics apply to Docker containers compared to virtual machines? (Choose two.)

Select 2 answers

A.Containers share the host kernel

B.Containers have faster startup times

C.Containers provide stronger isolation

D.Containers include a full guest operating system

E.Containers require a hypervisor

AnswersA, B

Containers share the host kernel, making them more efficient.

Why this answer

Docker containers share the host kernel, unlike virtual machines which each run their own kernel. This is because containers are implemented as isolated user-space instances (using namespaces and cgroups) that all run on top of the same host OS kernel. This shared kernel architecture eliminates the need for a separate guest OS per container, making containers lightweight and fast to start.

Exam trap

CompTIA often tests the misconception that containers provide stronger isolation than VMs, but the correct understanding is that VMs offer hardware-level isolation via a hypervisor, while containers share the host kernel and thus have weaker isolation boundaries.

Full explanation →

521

MCQmedium

A web server is running on the system but clients cannot connect to port 8080. Based on the exhibit, which command should the administrator run to allow traffic on port 8080?

A.firewall-cmd --add-rich-rule='rule port port=8080 protocol=tcp accept' --permanent

B.firewall-cmd --add-port=8080/tcp --permanent

C.firewall-cmd --add-port=8080/udp --permanent

D.firewall-cmd --add-service=http --permanent

AnswerB

This command adds TCP port 8080 permanently to the firewall rules, which is required for HTTPS on a non-standard port.

Why this answer

The correct command is `firewall-cmd --add-port=8080/tcp --permanent` because it opens TCP port 8080 in firewalld, which is the default firewall management tool on RHEL/CentOS 8/9. Since the web server is running but clients cannot connect, the firewall is likely blocking inbound traffic on that port. The `--add-port` option with the `tcp` protocol explicitly allows TCP connections, and `--permanent` makes the rule persist across reboots.

Exam trap

The trap here is that candidates confuse `--add-port` with `--add-service` or use the wrong protocol (UDP instead of TCP), or incorrectly format a rich rule, because the exam tests precise syntax and the distinction between service-based and port-based rules in firewalld.

How to eliminate wrong answers

Option A is wrong because `--add-rich-rule` syntax is incorrect; the correct rich rule syntax is `rule family=ipv4 port port=8080 protocol=tcp accept` (missing `family=ipv4` and using `port` instead of `port port`). Option C is wrong because it opens UDP port 8080, but HTTP/HTTPS traffic uses TCP, not UDP, so this would not allow web clients to connect. Option D is wrong because `--add-service=http` opens port 80 (the default HTTP port), not port 8080, which is a non-standard port often used for development or proxy servers.

Full explanation →

522

MCQmedium

In a Bash script, a variable is assigned the output of a command using: result=$(ls -l). What is the purpose of the $() syntax?

A.It runs the command and assigns its output to the variable

B.It expands the variable result

C.It checks if the command exists

D.It runs the command in a subshell and discards output

AnswerA

Correct. Command substitution runs the command and returns its stdout.

Why this answer

The $() syntax is command substitution, which captures the output of a command and stores it in a variable.

Full explanation →

523

MCQeasy

A systems administrator writes a Bash script named 'backup.sh' and wants it to run with the Bash shell. Which line should appear first in the script?

A.# This is a bash script

B.#!/bin/bash

C.#/bin/bash

D.#!/bin/sh

AnswerB

Correct shebang for Bash.

Why this answer

The shebang line `#!/bin/bash` is required as the first line to instruct the operating system to execute the script using the Bash shell interpreter located at `/bin/bash`. Without this line, the script may be run by a different shell (e.g., `/bin/sh`), leading to syntax or behavior differences. The shebang must start with `#!` followed by the absolute path to the interpreter.

Exam trap

CompTIA often tests the distinction between a shebang (`#!`) and a comment (`#`), and the trap here is that candidates may confuse `#!/bin/sh` as equivalent to `#!/bin/bash` or forget the exclamation mark entirely, leading them to choose option C or D.

How to eliminate wrong answers

Option A is wrong because `# This is a bash script` is a comment, not a shebang; the kernel ignores it and may fall back to the default shell, which is not guaranteed to be Bash. Option C is wrong because `#/bin/bash` lacks the exclamation mark (`!`), so it is treated as a regular comment and does not invoke the Bash interpreter. Option D is wrong because `#!/bin/sh` points to the POSIX shell, which may be Dash or another shell on many Linux distributions, not Bash; Bash-specific features (e.g., `[[ ]]`, arrays) would fail.

Full explanation →

524

MCQeasy

A technician has just performed system maintenance and wants to verify that the server has been running continuously for the past 30 days. Which command should the technician use?

A.uptime

B.systemctl status rsyslog

C.ps aux

D.date

AnswerA

Displays the system uptime and load averages.

Why this answer

The `uptime` command displays how long the system has been running since the last boot, including the current time, number of logged-in users, and load averages. By checking the output, the technician can verify if the server has been running continuously for the past 30 days (e.g., 'up 30 days'). This directly answers the question without querying logs or processes.

Exam trap

The trap here is that candidates might confuse `uptime` with commands that show service status (`systemctl`) or process lists (`ps`), thinking they can infer system uptime indirectly, but only `uptime` provides the exact boot-to-present duration.

How to eliminate wrong answers

Option B is wrong because `systemctl status rsyslog` shows the status of the rsyslog service (logging daemon), not the system's uptime; it only indicates if the service is running, not how long the server has been up. Option C is wrong because `ps aux` lists all running processes with their CPU/memory usage and start times, but it does not provide a single, consolidated uptime value for the entire system. Option D is wrong because `date` simply prints the current system date and time, offering no historical information about how long the server has been running.

Full explanation →

525

MCQmedium

A Linux administrator is troubleshooting login issues. Users can log in using SSH but not through the local console or graphical display manager. The /etc/pam.d/system-auth file was recently modified. Which PAM module is likely misconfigured?

A.pam_limits.so

B.pam_securetty.so

C.pam_deny.so

D.pam_unix.so

AnswerB

Controls which TTYs root may log in; if misconfigured, console login can be blocked.

Why this answer

The pam_securetty.so module restricts root login to terminals listed in /etc/securetty. If this file was misconfigured or the module is incorrectly set to 'required' for all users, local console and graphical display manager logins (which use virtual terminals like tty1) would be denied, while SSH (which uses pseudo-terminals like pts/0) would still succeed because pam_securetty.so typically does not apply to SSH sessions.

Exam trap

The trap here is that candidates confuse pam_securetty.so with pam_access.so or assume SSH is also blocked, but pam_securetty.so specifically targets local TTYs and does not affect SSH pseudo-terminals by default.

How to eliminate wrong answers

Option A is wrong because pam_limits.so enforces resource limits (e.g., ulimit) and does not control terminal-based login access; misconfiguring it would cause resource denial, not login failure at the console. Option C is wrong because pam_deny.so is a simple module that always returns failure; if it were misconfigured, it would block all authentication methods (including SSH), not selectively allow SSH. Option D is wrong because pam_unix.so handles traditional Unix password authentication and account management; a misconfiguration there would affect all login methods equally, not just local console and graphical display manager.

Full explanation →

CompTIA Linux+ (XK0-006) (XK0-006) — Questions 451–525