979 questions total · 14pages · All types, answers revealed
A system administrator needs to update a configuration file on multiple servers using Ansible. The playbook must ensure the line 'MaxAuthTries 3' is present in /etc/ssh/sshd_config. Which Ansible module is most appropriate?
lineinfile is designed to manage lines in text files.
Why this answer
The lineinfile module ensures a specific line is present in a file, ideal for configuration management.
An administrator needs to create a shell script that will be executed by a non-login shell. The script requires access to environment variables set in the user's profile. Which file should the script source to ensure these variables are available?
Correct. The .bashrc file is executed for non-login interactive shells and often contains environment variables.
Why this answer
~/.bashrc is the file sourced by non-login interactive shells in Bash. When a script is executed by a non-login shell, it does not read ~/.bash_profile or ~/.profile; instead, it reads ~/.bashrc. By sourcing ~/.bashrc within the script, the administrator ensures that environment variables defined there (e.g., PATH, custom aliases) are available to the script.
Exam trap
The trap here is that candidates often confuse ~/.bash_profile and ~/.bashrc, assuming that any user-specific profile file is sourced by all shells, but the key distinction is that non-login shells only source ~/.bashrc, not the login-specific profile files.
How to eliminate wrong answers
Option B is wrong because /etc/profile is a system-wide profile file sourced only by login shells, not by non-login shells. Option C is wrong because ~/.profile is a login shell initialization file (used by Bourne-compatible shells) and is not read by non-login shells. Option D is wrong because ~/.bash_profile is also a login shell initialization file for Bash; non-login shells do not source it.
Refer to the exhibit. Alice is the owner of file.txt. Bob is a member of the staff group. What permissions does Bob have on file.txt?
The ACL entry 'user:bob:r--' gives read permission.
Why this answer
Bob has read-only access because the ACL (Access Control List) for file.txt includes an entry 'user:bob:r--', which grants Bob read permission. This ACL entry overrides any group permissions, so even though the group 'staff' may have different permissions, Bob's effective permissions are determined by the ACL entry specific to him.
Exam trap
A common pitfall is assuming that group membership determines Bob's access, but the ACL entry for Bob as an individual user takes precedence. Always check for user-specific ACL entries before evaluating group permissions.
How to eliminate wrong answers
Option B is wrong because the group permissions are r--, not rw-, so Bob does not have write access. Option C is wrong because Bob has read access via the group permissions, so he does have access. Option D is wrong because the group permissions include read (r) but not write (w), so Bob cannot write only; he can read only.
Which command will show the environment variables for a specific process?
Reading /proc/<pid>/environ displays the environment variables of that specific process.
Why this answer
The `/proc/[PID]/environ` file contains the environment variables that were set when the process was started. Reading this file with `cat` displays the exact environment of a specific process, which is not possible with shell built-ins or user-level commands that only show the current shell's environment.
Exam trap
CompTIA often tests the distinction between commands that show the current shell's environment (`set`, `printenv`, `env`) versus the `/proc` filesystem method that targets a specific process, leading candidates to pick a shell command instead of the process-specific file.
How to eliminate wrong answers
Option B is wrong because `set` displays all shell variables (including environment and local variables) for the current shell session, not for a specific process. Option C is wrong because `printenv` prints the environment variables of the current shell, not of an arbitrary process. Option D is wrong because `env` lists or modifies the environment of the current shell, and cannot target a specific process by PID.
A Linux server is not accepting SSH connections. The administrator wants to troubleshoot the issue. Which THREE actions should be taken?
Correct: Misconfiguration can prevent connections.
Why this answer
B is correct because /etc/ssh/sshd_config is the primary configuration file for the OpenSSH server. Syntax errors, incorrect directives (e.g., PermitRootLogin no, Port 22 commented out), or misconfigured authentication settings can prevent SSH from accepting connections. Checking this file is a fundamental step in troubleshooting SSH issues.
Exam trap
CompTIA often tests the misconception that reinstalling a package or rebooting is a valid first troubleshooting step, when in reality, checking configuration files, service status, and firewall rules are the precise, targeted actions required.
An administrator runs 'systemctl list-units' and sees that httpd.service is in a failed state. To quickly see the error message that caused the failure, which command should be used?
systemctl status shows the unit status along with the last few log entries that led to the failure.
Why this answer
The `systemctl status httpd.service` command displays the current state of the service, including the most recent log entries from the journal that show the error messages causing the failure. This is the quickest way to see the failure reason without filtering or additional options, as it directly outputs the relevant error lines from the service's unit.
Exam trap
The trap here is that candidates often confuse `systemctl status` with `journalctl -u` or `systemctl show`, thinking they need a separate log-viewing command, but `systemctl status` already provides the most recent error output directly, making it the fastest diagnostic tool for a failed service.
How to eliminate wrong answers
Option A is wrong because `systemctl show httpd.service -p ExecMainStatus` only outputs the numeric exit code or signal of the main process (e.g., 0 for success, 1 for generic error), not the descriptive error message or log output that caused the failure. Option B is wrong because `journalctl -p err -u httpd.service` filters journal entries to only those with priority 'err' (error) for the httpd unit, which may miss critical failure messages logged at a different priority (e.g., 'crit' or 'alert') and requires an extra command compared to `systemctl status`. Option D is wrong because `systemd-analyze blame` shows the time each unit took to start during boot, not the error messages or failure reasons for a currently failed service.
A script uses 'set -e' and then calls a function that returns a non-zero exit status. The script exits unexpectedly. Which of the following should be added to the function to prevent the script from exiting?
Disables exit-on-error for the function, allowing non-zero exit codes without terminating.
Why this answer
The `set -e` directive causes the shell to exit immediately if any command returns a non-zero exit status. When a function called from such a script returns a non-zero status, the script exits. Adding `set +e` inside the function disables this behavior for the function's scope, allowing the function to handle errors internally without terminating the entire script.
Exam trap
The trap here is that candidates often think `return 0` or `exit 0` will override the non-zero exit status, but they fail to realize that `set -e` causes the script to exit immediately when the command fails, before any subsequent `return` or `exit` statement is executed.
How to eliminate wrong answers
Option A is wrong because `return 0` after the command would only succeed if the command itself does not cause an exit before the return statement; if the command fails and `set -e` is active, the script exits before reaching the `return 0`. Option C is wrong because `exit 0` would immediately terminate the script with a success code, which defeats the purpose of preventing an unexpected exit and does not allow the function to continue or return control to the caller. Option D is wrong because `trap '' ERR` prevents the ERR trap from running but does not disable the `set -e` behavior; the script will still exit on a non-zero exit status from any command.
An administrator is hardening a Linux server. Which three of the following actions reduce the attack surface? (Select THREE).
Reduces potential entry points for attackers.
Why this answer
Disabling unnecessary services reduces the attack surface by eliminating potential entry points for attackers. Each running service exposes network ports, system resources, and code paths that could contain vulnerabilities. By stopping and masking services not required for the server's role (e.g., using systemctl disable and mask), the administrator minimizes the number of exploitable components.
Exam trap
CompTIA often tests the misconception that setting a restrictive umask or enabling USB storage is a hardening action, when in fact umask 022 is the default and permissive, and enabling USB storage expands the attack surface rather than reducing it.
A database server is experiencing slow queries. The administrator wants to analyze system memory usage. Which command shows memory usage in megabytes and includes information about buffers and cache?
Correct: Displays memory in MB with buffers/cache.
Why this answer
The 'free -m' command displays system memory usage in megabytes, explicitly showing separate columns for buffers and cache, which are critical for diagnosing slow queries caused by memory pressure. This makes it the correct choice for the administrator's need to analyze memory usage with buffer/cache details in MB.
Exam trap
CompTIA often tests the distinction between commands that show memory in raw kernel units (like /proc/meminfo in kB) versus those that offer user-friendly output with specific columns (like free -m), leading candidates to choose /proc/meminfo for its detail while missing the explicit requirement for megabytes and buffer/cache breakdown.
How to eliminate wrong answers
Option B is wrong because 'top -b' runs top in batch mode, which shows real-time process-level memory and CPU usage but does not display memory in megabytes by default and lacks the dedicated buffers/cache breakdown that 'free -m' provides. Option C is wrong because 'cat /proc/meminfo' outputs raw memory statistics in kilobytes, not megabytes, and requires manual calculation to convert to MB, making it less convenient for the specified requirement. Option D is wrong because 'vmstat' reports virtual memory statistics including swap, I/O, and system events, but it does not show memory usage in megabytes and does not include explicit buffers and cache columns in its default output.
A Kubernetes pod has a container that fails with CrashLoopBackOff. The administrator runs 'kubectl logs pod-name' but sees no output. What is the most likely cause?
Correct: use --previous to see previous container logs.
Why this answer
When a container enters CrashLoopBackOff, it restarts repeatedly. If 'kubectl logs pod-name' shows no output, it means the current (restarted) container has not written anything to stdout yet. The previous instance of the container may have written logs before crashing, and those logs are accessible using 'kubectl logs --previous' to retrieve the output from the terminated container.
Exam trap
The trap here is that candidates assume 'no output' means logs are missing or misconfigured, when in fact the current container simply hasn't written anything yet, and the previous container's logs are still available via --previous.
How to eliminate wrong answers
Option B is wrong because Kubernetes does not require a separate logging driver configuration; it captures container stdout/stderr by default via the container runtime interface (CRI). Option C is wrong because log rotation and deletion would not cause an empty log output on a freshly restarted container; the current container simply hasn't produced logs yet. Option D is wrong because if the pod were not scheduled on any node, 'kubectl logs' would return an error like 'Error from server: pod is not scheduled', not an empty output.
In a bash script, a variable is set as follows: myvar='Hello World'. Which of the following correctly prints the first 5 characters of the variable?
Correct. Extracts substring of length 5 from start.
Why this answer
Parameter expansion ${myvar:0:5} extracts a substring starting at position 0 of length 5. The other options are incorrect syntax.
A Docker container using port 8080 fails to start with the error 'port is already allocated'. Which command should the administrator use to identify the process using that port?
Shows listening TCP ports with PID.
Why this answer
The `ss -tlnp` command lists TCP listening sockets (`-l`) with numeric addresses (`-n`) and shows the process identifier (PID) and process name (`-p`) that owns each socket. This directly identifies which process has bound port 8080, allowing the administrator to resolve the 'port is already allocated' error.
Exam trap
The trap here is that candidates may choose `ss -tln` (option B) because it shows listening ports, but they forget the `-p` flag is required to identify the process, leading to incomplete troubleshooting.
How to eliminate wrong answers
Option A is wrong because `ss -tan` lists all TCP sockets (including non-listening ones) without showing process ownership, so it cannot identify the process using port 8080. Option B is wrong because `ss -tln` lists TCP listening sockets but omits the `-p` flag, so it does not display the PID or process name, leaving the process unidentified. Option D is wrong because `ss -r` attempts to resolve hostnames and is not a valid flag combination for socket statistics; it does not list sockets or processes.
Refer to the exhibit. A system administrator checks the status of the SSH service and sees the output shown. What is the most likely cause of the failure?
The error 'Address already in use' indicates port 22 is occupied.
An administrator is debugging a Docker container that exits immediately after starting. Which THREE commands can help diagnose the issue? (Select THREE).
Starts a new container interactively with a shell to test manually.
Why this answer
docker logs shows the container's output; docker exec -it can run commands inside a running container (but if it exits, you may need to start it interactively); docker inspect shows low-level config and state; docker ps shows running containers, not helpful for exited ones.
An administrator needs to determine why a service failed to start due to an unresponsive network filesystem. Which systemd unit dependency directive should be added to ensure the service starts only after the remote filesystem is mounted?
Requires creates a strong dependency; the mount must be active for the service to start.
Why this answer
The Requires directive creates a strong dependency where the service unit will fail to start if the specified remote filesystem unit is not active. This ensures the service only starts after the remote filesystem is mounted, as systemd will attempt to start the required unit and fail the service if it cannot be activated.
Exam trap
The trap here is that candidates confuse ordering directives (After) with dependency directives (Requires), mistakenly thinking that ordering alone ensures the service will not start if the filesystem is unavailable.
How to eliminate wrong answers
Option A is wrong because Wants creates a weaker dependency: the service will start even if the remote filesystem fails to mount, which does not prevent the service from starting when the filesystem is unresponsive. Option B is wrong because After only orders the startup sequence but does not enforce a dependency; the service could still start before the filesystem is mounted if the filesystem unit fails. Option C is wrong because BindsTo creates a stronger lifecycle binding where the service stops if the filesystem unit stops, but it does not guarantee the service waits for the filesystem to be mounted before starting; it is typically used for shared mount points, not for ensuring startup order.
A junior administrator needs to check the disk usage of the /var filesystem to ensure it does not exceed 80% capacity. Which command should be used?
The `df -h` command with the `/var` argument queries the kernel’s mounted-filesystem table for the `/var` mount point, reporting used blocks and inodes in human-readable units (e.g., GiB). The `-h` flag converts raw 1024-byte blocks into scaled output, enabling the junior administrator to compare the “Use%” column directly against the 80% capacity constraint specified in the stem.
Why this answer
The `df -h /var` command displays disk usage for the `/var` filesystem in human-readable format (e.g., GB, MB). This is the correct tool to check filesystem capacity and usage percentage, which directly answers whether usage exceeds 80%.
Exam trap
The trap here is that candidates confuse `du` (directory usage) with `df` (filesystem usage), leading them to pick `du -sh /var` when they need to check overall filesystem capacity, not just the size of the directory contents.
How to eliminate wrong answers
Option B is wrong because `fdisk -l` lists partition tables on block devices, not filesystem usage; it cannot show capacity percentages for a mounted filesystem like `/var`. Option C is wrong because `du -sh /var` shows the total size of the `/var` directory tree, not the filesystem's total capacity or usage percentage; it is used for directory-level disk usage, not filesystem-level capacity checks. Option D is wrong because `lsblk` lists block devices (e.g., disks, partitions) and their mount points, but does not report filesystem usage or capacity percentages.
A developer is writing a shell script that needs to handle errors. Which THREE of the following are best practices for robust script error handling?
Allows conditional handling.
Why this answer
Checking the exit code of commands using `$?` allows the script to conditionally handle failures based on the specific return value of each command. This is a fundamental error-handling technique in shell scripting, as every command returns an exit code (0 for success, non-zero for failure), and inspecting `$?` immediately after a command lets the developer decide how to respond to that specific error.
Exam trap
CompTIA often tests the distinction between `set -e` and `set +e` and the proper use of `$?` versus relying solely on `set -e`, where candidates may incorrectly think that `set +e` is a best practice for error handling when it actually disables automatic exit on error.
A Linux administrator is troubleshooting a Bash script that unexpectedly terminates when a command fails. The script uses `#!/bin/bash`. Which of the following commands, if placed at the beginning of the script, would cause it to exit on any command failure?
set -e exits the script on any command failure.
Why this answer
The `set -e` option makes the shell exit immediately if a command exits with a non-zero status.
A developer creates a hard link to a file and then deletes the original file. What happens to the hard link?
Correct: The hard link still points to the same inode, so the data remains.
Why this answer
Hard links share the same inode; deleting the original file removes one link, but the data remains accessible via the hard link until all links are removed.
A user is unable to resolve hostnames on a Linux system. Which three configuration files should be checked? (Select THREE).
Static mapping of hostnames to IP addresses.
Why this answer
The /etc/hosts file is a static table mapping hostnames to IP addresses, used for local name resolution before or instead of DNS queries. If a user cannot resolve hostnames, this file may be misconfigured or missing entries for the target hostnames, causing resolution failures.
Exam trap
CompTIA often tests the misconception that /etc/hostname or /etc/sysconfig/network are involved in hostname resolution, when in fact they only affect the local system's identity, not the resolution of external hostnames.
A storage administrator needs to automate the expansion of an LVM volume group when free space drops below 10%. The script must add a new physical volume from a spare disk. Which of the following commands should be used in the script to add the new disk to the volume group?
Initializes the partition as a PV and adds it to the VG.
Why this answer
It first uses `pvcreate` to initialize the spare disk partition `/dev/sdb1` as a physical volume, which is a prerequisite for adding it to an LVM volume group. Then `vgextend vg01 /dev/sdb1` adds that initialized physical volume to the existing volume group `vg01`, expanding its total capacity. This two-step process ensures the disk is properly prepared for LVM management before being incorporated into the volume group.
Exam trap
The trap here is that candidates often think `vgextend` alone is sufficient, forgetting that LVM requires the device to be initialized as a physical volume with `pvcreate` before it can be added to a volume group.
How to eliminate wrong answers
Option B is wrong because `vgcreate` creates a new volume group, but the requirement is to add a disk to an existing volume group, not create a new one. Option C is wrong because `vgextend` alone will fail if `/dev/sdb1` has not been initialized as a physical volume with `pvcreate` first; LVM requires the device to be marked as a PV before it can be added to a VG. Option D is wrong because `lvresize` resizes a logical volume, not a volume group, and the task is to expand the volume group by adding a new physical volume, not to resize a logical volume.
A system is running SELinux in enforcing mode. A custom application needs to write to /var/log/app.log. The log file shows the correct context, but access is denied. What is the most likely cause?
Many applications require a boolean to be enabled.
Why this answer
SELinux policy may not allow the application's domain to write to that file; audit2allow can generate a policy. But the question implies a boolean or context issue. However, typical cause is missing policy rule.
But among options, 'The application is running in an unconfined domain' is plausible but not best. Actually, the most common cause is that the file context is wrong. But given the file has correct context, the issue is likely a boolean or policy.
However, the best answer is 'A transition to the wrong domain'? I'll go with 'The SELinux boolean for the application is disabled'.
Match each Linux boot component to its role.
Drag a concept onto its matching description — or click a concept then click the description.
Bootloader
Initial RAM disk
Init system and service manager
Compressed Linux kernel
Tool to create initramfs
Why these pairings
The Linux boot process: BIOS/UEFI loads GRUB → GRUB loads kernel & initramfs → kernel initializes hardware, mounts initramfs, loads drivers, then mounts real root and starts systemd → systemd manages services.
A user cannot access a directory '/data/projects' even though they are in the 'projects' group. The directory permissions are 'drwxr-x---' and the group owner is 'projects'. Which command should the administrator run to grant the group write permission?
Adds write permission for the group.
Why this answer
The directory '/data/projects' has permissions 'drwxr-x---', meaning the group owner 'projects' currently has read and execute (r-x) but not write (w) access. Since the user is a member of the 'projects' group, the administrator needs to add write permission for the group using 'chmod g+w /data/projects'. This directly modifies the group permission bits to grant write access without affecting other permissions.
Exam trap
CompTIA often tests the distinction between changing ownership (chown) and changing permissions (chmod), and candidates mistakenly think that setting the group owner again will grant write access, when in fact only chmod modifies the permission bits.
How to eliminate wrong answers
Option B is wrong because 'chmod o+w' adds write permission for 'others' (users not the owner and not in the group), which is unnecessary and would over-permit the directory, violating the principle of least privilege. Option C is wrong because 'chmod u+w' adds write permission for the user owner, not the group; the user owner is typically 'root' or another user, not the 'projects' group. Option D is wrong because 'chown :projects /data/projects' changes the group owner to 'projects', but the group already owns the directory, so this command does nothing to change permissions; it does not grant write access.
An administrator wants to list all files in the current directory that are larger than 1 MB. Which find commands are correct? (Choose two.)
Correct. This command correctly lists regular files larger than 1 MB. The -type f ensures only regular files are considered, and -size +1M matches files larger than 1 MB.
Why this answer
Both options A and D are syntactically correct and will produce the same result. The find command evaluates expressions in order, but the -type and -size conditions are independent; their order does not affect functionality. Option A (find . -type f -size +1M) specifies file type before size, while option D (find . -size +1M -type f) specifies size before file type.
Both are valid because find processes predicates left-to-right, but since -type f filters by file type and -size +1M filters by size, any file that does not satisfy both will be excluded regardless of order.
A Linux administrator is troubleshooting a server that has become unresponsive. The administrator connects via IPMI and runs 'top' but the process list does not show any obvious CPU or memory hog. Which TWO commands could be used to identify I/O wait issues or disk bottlenecks? (Choose TWO.)
iostat -x shows extended I/O statistics per device.
Why this answer
`iostat -x 1` provides extended disk I/O statistics, including `%util` (percentage of time the device was busy servicing requests) and `await` (average time for I/O operations). These metrics directly indicate disk bottlenecks and I/O wait issues. `iotop -o` displays only processes that are currently performing I/O operations, allowing the administrator to identify which specific processes are causing disk contention.
Exam trap
The trap here is that candidates often choose `vmstat 1` because it shows the `wa` column, but they overlook that it does not provide per-disk or per-process granularity needed to identify the specific source of I/O wait.
A sysadmin needs to set a default gateway for a network interface. Which command(s) accomplish this?
This option combines A and B, but since A is not a command that sets a default gateway, D is incorrect.
Why this answer
Both the legacy `route` command (route add default gw 192.168.1.1) and the modern `ip route` command (ip route add default via 192.168.1.1) can be used to set a default gateway. Therefore, the correct choice is D, which includes both valid commands. `netstat -rn` only displays routing information and cannot modify routes.
Exam trap
The trap here is that candidates may think only the modern `ip route` command works, forgetting that the legacy `route` command is still accepted on many Linux distributions, or they may mistakenly believe `netstat -rn` can set a route because it displays routing information.
How to eliminate wrong answers
Option A is wrong because `netstat -rn` is a read-only command that displays the kernel routing table; it does not modify or set a default gateway. Option B is wrong because `route add default gw 192.168.1.1` is a valid legacy command that does set a default gateway, so it is not incorrect. Option C is wrong because `ip route add default via 192.168.1.1` is also a valid modern command that sets a default gateway, so it is not incorrect.
The question asks which command(s) accomplish the task, and both B and C work, making D the correct answer.
A DevOps engineer wants to run a Docker container with a bind mount to make a host directory /data available at /mnt/data inside the container. Which command is correct?
Correct as explained.
Why this answer
The `--mount` flag with `type=bind` explicitly creates a bind mount, mapping the host directory `/data` to the container path `/mnt/data`. This syntax is more explicit and less error-prone than the older `-v` flag, especially when dealing with bind mounts on directories that do not exist yet or when additional mount options are needed.
Exam trap
The trap here is that candidates often assume the `-v` flag always creates a bind mount, but Docker's `-v` syntax can create either a bind mount or a volume depending on whether the source is an absolute path (bind) or a name (volume), and the `--mount` flag with explicit `type=bind` is the unambiguous, recommended method for bind mounts.
How to eliminate wrong answers
Option A is wrong because the `:bind` suffix is not a valid mount option in the `-v` syntax; the `-v` flag uses a colon-separated list of host-path:container-path[:options], and while `:ro` or `:z` are valid, `:bind` is not recognized. Option B is wrong because while `-v /data:/mnt/data` does create a bind mount by default when the source is an absolute path, it is ambiguous and can be confused with a volume mount; the `--mount` syntax is the recommended modern approach for clarity. Option D is wrong because `type=volume` creates a named Docker volume, not a bind mount; using `source=/data` with a volume type would treat `/data` as a volume name rather than a host directory path, which is not what the question asks.
Which THREE methods are valid for setting the default systemd target (runlevel) to multi-user mode? (Choose three.)
This is the standard command to set default target.
Why this answer
`systemctl set-default multi-user.target` is the standard systemd command to permanently change the default boot target to multi-user mode (runlevel 3). This command updates the symlink at `/etc/systemd/system/default.target` to point to `/lib/systemd/system/multi-user.target`, ensuring the system boots into a non-graphical, multi-user state.
Exam trap
The trap here is that candidates confuse runtime runlevel changes (via `telinit` or `init`) with persistent default target changes, or they mistakenly think editing `/etc/inittab` still works on modern systemd-based systems.
After a kernel update, loading a proprietary kernel module fails with 'Invalid module format'. The module was built from source against the previous kernel. What is the most likely cause?
Kernel modules are tied to a specific kernel version; they must be recompiled after a kernel update.
Why this answer
The 'Invalid module format' error occurs when a kernel module's version magic string does not match the running kernel's version. Since the module was built against the previous kernel, it contains version information for that older kernel, and the new kernel rejects it as incompatible. Rebuilding the module against the new kernel's headers resolves this mismatch.
Exam trap
The trap here is that candidates confuse the 'Invalid module format' error with Secure Boot signing issues, but Secure Boot produces a different error message related to key verification, not format mismatch.
How to eliminate wrong answers
Option A is wrong because Secure Boot with unsigned modules typically produces a 'Required key not available' or 'Module verification failed' error, not 'Invalid module format'. Option B is wrong because incorrect file permissions would cause a 'Permission denied' error when trying to insmod, not a format error. Option C is wrong because SELinux denials generate AVC denial messages in the audit log and would prevent loading due to policy restrictions, not an 'Invalid module format' error.
A Linux administrator notices that the system’s disk I/O performance has degraded significantly. Running 'iostat -x 1' shows high %util values on /dev/sda, but low await. Which of the following is the most likely issue?
Parallel I/O keeps the device busy (%util high) but each request is serviced quickly (low await).
Why this answer
High %util with low await indicates that the device is busy processing many concurrent I/O requests, but each request completes quickly. This is characteristic of a high queue depth where the disk is saturated with parallel requests, not that individual requests are slow. The low await confirms that the disk itself is responding fast, so the bottleneck is the volume of simultaneous I/O, not latency per request.
Exam trap
CompTIA often tests the misconception that high %util always means slow I/O, but the trap here is that %util measures busy time, not latency; candidates overlook the low await and incorrectly assume hardware failure or cable issues.
How to eliminate wrong answers
Option A is wrong because a nearly full filesystem affects metadata operations and may cause fragmentation, but it does not directly cause high %util with low await; it would more likely increase await due to slower allocation. Option B is wrong because a loose or faulty disk cable typically causes intermittent errors, timeouts, or complete disconnection, which would manifest as high await and possibly errors in iostat, not high %util with low await. Option D is wrong because a failing disk usually produces high await, increased error counts, and reallocated sectors, not a scenario where requests complete quickly (low await) while the device is busy.
A security policy requires that user passwords must expire after 90 days. The output in the exhibit shows the current configuration for the root user. Which command should the administrator run to enforce the policy for root?
Sets the maximum number of days a password remains valid.
Why this answer
The `chage -M 90 root` command sets the maximum number of days a password is valid for the root user to 90 days, which directly enforces the password expiration policy. The `-M` option modifies the `max_days` field in `/etc/shadow`, causing the password to expire after the specified period. This is the correct method to apply aging rules to the root account.
Exam trap
The trap here is that candidates confuse the `chage -M` (maximum password age) with `chage -E` (account expiration) or `usermod -e` (account expiration), leading them to select options that set account expiry instead of password expiry, which does not enforce the 90-day password change requirement.
How to eliminate wrong answers
Option A is wrong because `passwd -x 90 root` is not a valid syntax; the `passwd` command uses `-x` to set maximum password days but requires the option before the username (e.g., `passwd -x 90 root`), and even then it only works if the user is not root or if run as root without `sudo`; however, the primary issue is that the question asks for the command to enforce the policy, and `chage` is the standard tool for password aging policies. Option C is wrong because `chage -E 90 root` sets the account expiration date to a specific date (interpreted as days since epoch or a date string), not the password maximum age; `-E` controls account expiry, not password expiry. Option D is wrong because `usermod -e 90 root` sets the account expiration date (in YYYY-MM-DD format or days since epoch), not the password maximum age; `-e` is for account expiry, while `-f` or `-L` would be unrelated, and password aging is managed via `chage` or `passwd`.
A user on a workstation with IP 192.168.1.100 reports being unable to SSH to the server with IP 10.0.0.5. Based on the exhibit, what is the most likely cause?
The fifth line shows SSH accepted only from source 10.0.0.0/8; the user's IP is not in that range.
Why this answer
The exhibit shows an iptables ruleset where the SSH rule (port 22) explicitly matches the source address 10.0.0.0/8. The workstation has IP 192.168.1.100, which does not fall within the 10.0.0.0/8 range, so the SSH rule will not match. Since no other rule allows SSH, the packet will be evaluated against the default INPUT policy, which is ACCEPT (not shown as DROP), but the SSH rule itself restricts the source, making it unreachable for this client.
Exam trap
The trap here is that candidates assume any rule with 'ACCEPT' for SSH is sufficient, overlooking the source address restriction, and they may also mistakenly think a LOG rule blocks subsequent rules, when in fact LOG is non-terminating.
How to eliminate wrong answers
Option A is wrong because the default INPUT policy is ACCEPT (as indicated by the policy ACCEPT line in the exhibit), not DROP, so packets not matching any rule would be accepted by default. Option B is wrong because iptables processes rules sequentially; a LOG rule does not terminate the chain (it is a non-terminating target), so subsequent rules, including the SSH rule, are still reachable. Option D is wrong because the SSH port (22) is explicitly allowed in the rule that matches source 10.0.0.0/8; the issue is the source restriction, not the port being absent.
A system administrator is investigating a slow website. The web server is responding but pages load slowly. Which THREE commands can help identify network latency or packet loss?
mtr shows per-hop loss and latency.
Why this answer
B is correct because `mtr` (My TraceRoute) combines the functionality of `ping` and `traceroute` into a single diagnostic tool. It continuously sends ICMP packets to each hop along the path to the target, displaying per-hop latency and packet loss statistics in real time. This makes it ideal for identifying where network latency or packet loss is occurring between the server and the client, which directly addresses the symptom of a slow website.
Exam trap
CompTIA often tests the distinction between `traceroute` (which shows a single snapshot of path latency) and `mtr` (which provides ongoing, aggregated statistics including packet loss per hop), leading candidates to overlook `mtr` as a superior tool for diagnosing intermittent or persistent network issues.
An administrator is troubleshooting a server that is experiencing intermittent high load. The administrator wants to identify processes that are using excessive CPU. Which two of the following commands can provide real-time CPU usage per process? (Choose two.)
htop also provides real-time process monitoring.
Why this answer
A is correct because `htop` is an interactive process viewer that displays real-time CPU usage per process, with a color-coded interface and the ability to sort by CPU consumption. B is correct because `top` is the standard real-time system monitor that shows a dynamic list of processes and their current CPU utilization, updating every few seconds by default.
Exam trap
CompTIA often tests the distinction between real-time monitoring commands and static snapshot commands; the trap here is that `ps -aux` shows CPU usage but only at the instant of execution, leading candidates to mistakenly think it provides real-time updates like `top` or `htop`.
A Linux administrator needs to ensure that only the root user can run commands in the /usr/local/bin/scripts directory. Which command should be used to set the appropriate permissions?
Owner (root) gets rwx; group and others have no access.
Why this answer
The requirement is that only the root user can run commands in the directory. Permission 700 (owner: rwx, group: ---, others: ---) grants full access exclusively to the owner (root), while denying all access to the group and others. This matches the requirement precisely.
Exam trap
The trap here is that candidates often choose 755 or 750 as 'standard' permissions for directories, forgetting that the requirement explicitly restricts access to only root, not to any group or other users.
How to eliminate wrong answers
Option A (750) is wrong because it grants read and execute permissions to the group, allowing group members (other than root) to list and run scripts, which violates the 'only root' requirement. Option C (755) is wrong because it grants read and execute to both group and others, allowing any user on the system to list and execute scripts. Option D (770) is wrong because it grants full read, write, and execute to the group, allowing group members to modify and run scripts, which again violates the restriction to root only.
During peak hours, a web server experiences timeouts. The kernel log shows 'possible SYN flooding'. Which kernel parameter should be increased to mitigate this?
Increasing this value allows more half-open connections, reducing SYN flooding issues.
Why this answer
The kernel log message 'possible SYN flooding' indicates that the system's SYN backlog queue is full, causing new connection requests to be dropped. Increasing `net.ipv4.tcp_max_syn_backlog` expands the maximum number of SYN requests that can be queued before the kernel starts dropping them, directly mitigating the issue.
Exam trap
The trap here is confusing the SYN backlog queue (`tcp_max_syn_backlog`) with the completed connection backlog (`somaxconn`), leading candidates to choose `net.core.somaxconn` even though it only affects fully established connections, not the SYN flood protection mechanism.
How to eliminate wrong answers
Option A is wrong because `net.ipv4.tcp_syncookies` enables SYN cookies as a defense against SYN flood attacks, but it does not increase the queue size; it bypasses the backlog entirely, which can degrade performance for legitimate traffic. Option B is wrong because `net.core.somaxconn` limits the maximum number of connections that can be queued for a listening socket after the three-way handshake is complete, not the SYN backlog queue for half-open connections. Option D is wrong because `net.core.rmem_default` sets the default receive socket buffer size for data transfer, which has no effect on the SYN backlog or connection establishment.
A DevOps engineer is writing a Bash script to automate deployment of a containerized application. The script must: (1) exit immediately if any command fails, (2) build a Docker image with tag 'myapp:latest' from the current directory, (3) run a container from that image in detached mode with port mapping 8080:80, (4) set environment variable ENV=production inside the container, and (5) bind mount a host directory /data to /app/data inside the container. Which TWO of the following snippets should be included in the script to meet these requirements? (Choose TWO.)
Correct. `set -e` causes the script to exit if any command fails, satisfying requirement 1.
Why this answer
(`set -e`) ensures the script exits immediately if any command fails, satisfying requirement 1. Option C (`docker build -t myapp:latest .`) builds the Docker image with the required tag, satisfying requirement 2. The run commands (A and E) are not selected because requirement 2 (building the image) must be completed before running the container, and the question asks for two snippets that meet the requirements; the run command would be a separate part of the script.
Option D is also a valid build command but uses the long form `--tag`; either C or D would work, but C is the more common short form. Option E has a syntax error (`-eENV=production` missing space).
A Linux server is running low on disk space in the /var partition. The administrator runs 'du -sh /var/log/*' and finds that /var/log/syslog is 10 GB. Which of the following is the BEST long-term solution to prevent recurrence?
logrotate automates rotation, keeping log sizes manageable.
Why this answer
Logrotate is the standard Linux utility for managing log file growth. By configuring logrotate to rotate and compress /var/log/syslog daily, the system automatically archives old logs and prevents a single file from consuming excessive disk space, addressing the root cause without manual intervention.
Exam trap
The trap here is that candidates may confuse 'increasing rotation frequency' with 'reducing log size,' but increasing the interval (e.g., to monthly) actually worsens the problem, while daily rotation with compression is the correct long-term solution.
How to eliminate wrong answers
Option A is wrong because manually truncating the file with '> /var/log/syslog' only frees space temporarily; the syslog daemon will continue writing to the same file, and the problem will recur without any automated management. Option B is wrong because deleting the syslog file and restarting the service is disruptive, may cause loss of log data, and does not implement any automated rotation or retention policy. Option D is wrong because increasing the log rotation frequency to monthly would actually reduce rotation frequency, making the problem worse by allowing the syslog file to grow even larger between rotations.
A Linux administrator writes a script that uses bash-specific features like arrays and process substitution. Which shebang should be used?
Bash supports advanced features like arrays and process substitution.
Why this answer
The correct shebang is #!/bin/bash because the script uses bash-specific features such as arrays and process substitution. The shebang line tells the system to execute the script with the specified interpreter; /bin/bash is the Bourne Again SHell, which supports these features, while /bin/sh may be a POSIX shell that lacks them.
Exam trap
The trap here is that candidates often assume /bin/sh is always bash or that any shell can run bash-specific syntax, but on many Linux distributions /bin/sh is a different shell (e.g., dash) that lacks these extensions.
How to eliminate wrong answers
Option B is wrong because /bin/sh is often a POSIX-compliant shell (like dash on Debian) that does not support bash-specific features such as arrays and process substitution, causing the script to fail. Option C is wrong because /usr/bin/python3 is the Python 3 interpreter, which cannot execute bash syntax. Option D is wrong because /bin/ksh is the Korn shell, which has its own syntax and may not support bash-specific features like process substitution in the same way.
An administrator notices that new SSH sessions fail for all users. Which line in the exhibit is most likely causing the failure?
If /etc/nologin exists, this module denies login to all non-root users.
Why this answer
The line 'account required pam_nologin.so' causes new SSH sessions to fail because the pam_nologin module checks for the existence of /etc/nologin. If that file exists, it denies login to all non-root users. This is commonly used during maintenance to prevent new logins, and since the question states 'all users' (including root if root is not explicitly exempted), this PAM module is the direct cause of the failure.
Exam trap
The trap here is that candidates often confuse the 'account' stack with the 'auth' or 'session' stacks, mistakenly thinking a missing authentication module (like pam_sepermit.so) or a session module (like pam_loginuid.so) is the cause, when in fact the account-level pam_nologin.so is specifically designed to block new logins system-wide.
How to eliminate wrong answers
Option B is wrong because 'session include password-auth' is a session management line that handles post-authentication tasks like logging and does not prevent new SSH sessions from being established. Option C is wrong because 'auth required pam_sepermit.so' is an authentication module that enforces SELinux user mapping; it would cause authentication failures for specific users, not block all new SSH sessions globally. Option D is wrong because 'session required pam_loginuid.so' ensures a unique loginuid is set for auditing purposes; failure of this module would cause session setup to fail only if the loginuid cannot be set, but it does not block all new SSH sessions by default.
A system administrator wants to automate server configuration and management across multiple Linux hosts. Which TWO tools are configuration management solutions designed for this purpose? (Choose two.)
Puppet is a configuration management tool.
Why this answer
Puppet is a mature configuration management tool that uses a declarative language (Puppet DSL) to define desired system states and enforces them via a client-server (agent-master) architecture over HTTPS. It automates server configuration across multiple hosts by applying manifests that specify packages, services, files, and users, ensuring consistency without manual intervention.
Exam trap
The trap here is that candidates confuse containerization (Docker) or orchestration (Kubernetes) with configuration management, or mistake monitoring (Nagios) for a tool that configures systems, when the question specifically asks for tools that automate server configuration and management across multiple hosts.
Scenario: A cloud hosting company uses SELinux in enforcing mode on all Linux servers. A developer reports that a custom web application running under Apache (httpd) is unable to write log files to /var/log/myapp/. The directory /var/log/myapp/ has permissions 755 and is owned by root:root. The httpd process runs as the 'apache' user. The administrator checks SELinux context: /var/log/myapp is labeled with default_t type. The administrator wants to allow httpd to write to this directory while maintaining security. Which command should the administrator run?
This permanently sets the context to httpd_log_t, allowing httpd to write.
Why this answer
It permanently relabels the directory with the httpd_log_t SELinux type, which is specifically designed to allow Apache (httpd) to write log files. The semanage fcontext command adds a file context mapping to the SELinux policy database, and restorecon applies that mapping to the filesystem. This approach maintains SELinux enforcing mode and does not rely on temporary changes like chcon or insecure workarounds like disabling SELinux.
Exam trap
The trap here is that candidates often choose chcon (Option C) because it works immediately, but they overlook that it is not persistent and will be overwritten by restorecon or policy updates, whereas semanage fcontext followed by restorecon is the correct persistent method.
How to eliminate wrong answers
Option A is wrong because changing ownership to apache:apache does not address SELinux type enforcement; the httpd process is still blocked by the default_t type on the directory, regardless of Unix permissions. Option B is wrong because running 'setenforce 0' disables SELinux entirely, which violates the company's security policy of running in enforcing mode and exposes the server to potential threats. Option C is wrong because 'chcon -t httpd_log_t /var/log/myapp' only makes a temporary label change that will be reverted on the next filesystem relabel (e.g., after a policy update or restorecon run), and it does not persist in the SELinux policy database.
An administrator needs to check the kernel ring buffer for hardware error messages after a system crash. Which command should be used?
dmesg displays kernel ring buffer messages.
Why this answer
dmesg shows kernel ring buffer messages including hardware errors. journalctl -k shows kernel messages from systemd journal, but dmesg is the direct command for the ring buffer.
A Linux server is experiencing high CPU usage. Which TWO commands can be used to identify which processes are consuming the most CPU? (Choose two.)
ps with sorting shows processes by CPU usage.
Why this answer
top and ps are standard process monitoring tools that show CPU usage.
A security audit identifies that the system's /etc/passwd file is world-readable. Which three security issues does this pose? (Select THREE.)
/etc/passwd lists all local usernames.
Why this answer
The /etc/passwd file contains a list of all system usernames. Since the file is world-readable, any user or attacker can easily read this file to enumerate valid usernames, which is a common first step in password guessing or brute-force attacks. Usernames are stored in the first colon-delimited field of each line, making them trivially extractable.
Exam trap
The trap here is that candidates often confuse the legacy practice of storing password hashes in /etc/passwd with the modern shadow password suite, and mistakenly select options A or E, not realizing that /etc/shadow is the actual hash store.
Which command displays the current routing table on a Linux system?
Correct.
Why this answer
ip route shows the routing table. The older route command is deprecated.
A web server is not responding on port 443. Using tcpdump to capture traffic on the server, which filter would capture only HTTPS packets?
Correct filter: tcp port 443 captures TCP traffic on port 443.
Why this answer
Port 443 is HTTPS. The filter 'port 443' captures traffic on that port.
A Linux administrator needs to add a new user named 'jdoe' with a home directory and bash shell. Which command accomplishes this?
Correct: -m creates home directory, -s sets shell.
Why this answer
The useradd command creates a new user, and the -m flag creates the home directory, -s sets the shell. useradd -m -s /bin/bash jdoe is correct.
A developer is writing a Bash script that needs to test whether a file exists and is readable. Which of the following conditionals correctly performs this check?
Double brackets are preferred and allow && for logical AND.
Why this answer
The -f test checks for a regular file, and -r checks if it is readable. Both must be true, so they are combined with &&.
An administrator modified kernel parameters in /etc/sysctl.conf. Which command applies the changes without rebooting?
The -p option loads settings from the specified file, defaulting to /etc/sysctl.conf.
Why this answer
The `sysctl -p` command reads the settings from `/etc/sysctl.conf` and applies them immediately to the running kernel without requiring a reboot. This is the standard method for reloading persistent kernel parameter changes on Linux systems.
Exam trap
The trap here is that candidates confuse `sysctl -p` (apply from file) with `sysctl -w` (set a single value), or assume a reboot is required, leading them to choose an incorrect option like `sysctl -w` or a non-existent flag.
How to eliminate wrong answers
Option B is wrong because `sysctl -w` is used to temporarily set a single kernel parameter at runtime, not to load changes from a configuration file. Option C is wrong because `sysctl -r` is not a valid sysctl option; the correct flag for reloading from a file is `-p`. Option D is wrong because `sysctl -a` displays all current kernel parameters and their values, but does not apply or reload any configuration changes.
A Linux administrator is troubleshooting a service that fails to start. Which TWO commands can be used to view the last 20 lines of the systemd journal for the sshd unit?
Correct: -u for unit, -n for number of lines.
Why this answer
journalctl -u sshd -n 20 shows last 20 lines for the unit. journalctl -u sshd | tail -20 also works. The others use wrong options or units.
An administrator wants to start a long-running script in the background so that it continues running even after logging out. Which command should be used?
Correct: nohup allows process to survive logout; & runs in background.
Why this answer
nohup prevents the process from receiving SIGHUP when the terminal closes. & runs it in background.
Refer to the exhibit. A user wants to execute the script 'script.sh' but receives a 'Permission denied' error. Which action should be taken to allow execution?
Adds execute permission to the file.
Why this answer
The 'Permission denied' error indicates the script lacks the execute permission for the user. The `chmod +x script.sh` command adds the execute permission bit to the file's mode, allowing the user to run it as a program. This is the direct and correct fix for the issue.
Exam trap
CompTIA often tests the misconception that changing ownership or group alone resolves permission errors, when in fact the execute permission bit must be explicitly set for the file to be run as a script.
How to eliminate wrong answers
Option B is wrong because changing the owner with `chown` does not grant execute permission; it only changes file ownership, and the new owner still needs execute permission to run the script. Option C is wrong because changing the group to the user's primary group does not add execute permission; the group must have the execute bit set in the file's permissions for this to work. Option D is wrong because setting permissions to 644 (rw-r--r--) removes any execute bits, which would still prevent execution and is the opposite of what is needed.
A Linux system fails to boot, displaying a 'kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)' error. Which of the following is the most likely cause?
A missing or corrupted initramfs can prevent the root filesystem from being mounted.
Why this answer
This error indicates the kernel cannot find the root filesystem, often due to a missing driver or incorrect root= parameter in the boot configuration.
A developer writes a Dockerfile that installs multiple packages. To reduce the final image size, which of the following practices is most effective?
Reduces number of layers, decreasing image size.
Why this answer
Combining multiple RUN commands into a single RUN instruction reduces the number of layers created in the Docker image. Each RUN instruction creates a new layer, and by merging them, you avoid storing intermediate files (e.g., package cache) across separate layers, which significantly shrinks the final image size. This is a direct and effective method for minimizing image footprint when installing multiple packages.
Exam trap
CompTIA often tests the misconception that using a minimal base image or cleaning up in separate steps is sufficient, when in fact the layer persistence model means only combining RUN commands (and cleaning within the same layer) truly eliminates intermediate file bloat.
How to eliminate wrong answers
Option A is wrong because multi-stage builds primarily reduce image size by separating build-time dependencies from the final runtime image, but they do not directly address the layer overhead from multiple RUN instructions during package installation. Option C is wrong because apt-get clean only removes cached package files within a single layer; if used in separate RUN instructions, the cache is already stored in a previous layer and cannot be reclaimed, making it ineffective for reducing final image size. Option D is wrong because while using a minimal base image like Alpine reduces the base layer size, it does not mitigate the layer bloat caused by multiple RUN instructions; the question specifically asks about the practice for reducing image size when installing multiple packages, and combining RUN commands is more directly impactful.
An administrator wants to change the priority of a running process with PID 1234 to a lower priority (nicer). The current nice value is 0. Which command will set the nice value to 10?
Correct: renice sets the nice value for the process.
Why this answer
The `renice` command is used to alter the scheduling priority of an already running process. By default, a process starts with a nice value of 0. Running `renice 10 -p 1234` sets the nice value to 10, which is a lower priority (more 'nice') because the kernel adds this value to the dynamic priority calculation, giving the process less CPU time.
Exam trap
The Linux+ exam often tests the distinction between `renice` (for running processes) and `nice` (for launching a new process with a modified priority), and candidates may confuse `renice` with `nice` or think `kill` can change priority via signal numbers.
How to eliminate wrong answers
Option B is wrong because `nice -n 10 kill 1234` attempts to run the `kill` command with a nice value of 10, but `kill` does not change the priority of an existing process; it sends signals. Option C is wrong because `chrt -p 10 1234` sets the real-time scheduling policy and priority (via the `-p` flag with a priority value), not the nice value; `chrt` manipulates the SCHED_FIFO or SCHED_RR policy, not the conventional nice/renice mechanism. Option D is wrong because `kill -10 1234` sends signal 10 (SIGUSR1 by default on Linux) to the process, which has no effect on its nice value or scheduling priority.
A Linux administrator is writing a bash script that accepts command-line options: -a for all, -f for file, and -o for output. Which of the following correctly uses getopts to parse these options?
Correct. The option string 'afo' defines three boolean options without arguments.
Why this answer
getopts uses a string of option characters; a colon after an option indicates it requires an argument. The correct usage is 'a:f:o' where a and f require arguments, but the stem doesn't specify arguments. Assuming -a and -f don't require arguments, the string should be 'afo'.
A DevOps engineer is designing a CI/CD pipeline for a microservices application. The pipeline should build a Docker image, run unit tests, and if successful, push the image to a private registry. Which tool is best suited for orchestrating this pipeline?
Jenkins is designed for building, testing, and deploying software continuously.
Why this answer
Jenkins is a widely adopted CI/CD automation server that excels at orchestrating complex pipelines, including building Docker images, running unit tests, and pushing images to a private registry. Its pipeline-as-code feature (Jenkinsfile) allows defining stages, triggers, and post-build actions, making it the best fit for this microservices CI/CD workflow.
Exam trap
CompTIA often tests the distinction between CI/CD orchestration tools and general automation or scheduling tools; the trap here is that candidates may confuse Ansible's automation capabilities with CI/CD pipeline orchestration, or think cron can handle complex multi-step workflows with conditional logic.
How to eliminate wrong answers
Option A is wrong because Git is a distributed version control system used for source code management, not for orchestrating CI/CD pipelines or executing build/test/deploy steps. Option B is wrong because cron is a time-based job scheduler in Unix/Linux that can only run simple scripts at fixed intervals; it lacks pipeline logic, dependency management, and integration with Docker registries or test frameworks. Option D is wrong because Ansible is a configuration management and automation tool primarily used for provisioning and infrastructure as code, not for continuous integration pipeline orchestration; it does not natively support event-driven CI/CD triggers or pipeline stages.
A technician is troubleshooting a service that fails to start. The service file is located in /usr/lib/systemd/system. Which THREE commands can be used to investigate the service's status and logs? (Choose three.)
Shows logs for the service.
Why this answer
systemctl status shows service status; journalctl -u shows logs for the unit; journalctl -f follows new log entries. systemctl start attempts to start but not investigate; systemctl enable enables at boot.
Drag and drop the steps to set up a cron job that runs a script daily in the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Setting up a cron job correctly involves first writing the script that will be executed, then making it executable with chmod +x, then adding a crontab entry using crontab -e with the correct time specification (e.g., '0 0 * * *' for daily at midnight), and finally verifying the job is listed with crontab -l. This order ensures the script is ready and permissions are set before cron attempts to run it, and verification confirms the entry is valid.
A Linux administrator wants to view all listening TCP ports and the associated processes on a system. Which command should be used?
Correct command.
Why this answer
The `ss -tlnp` command is correct because it displays all TCP listening sockets (`-t` for TCP, `-l` for listening) with numeric addresses (`-n`) and shows the associated process information (`-p`). This is the modern replacement for `netstat` and is the recommended tool on current Linux distributions for socket statistics.
Exam trap
The trap here is that candidates may choose `netstat -tulpn` (Option B) because it is historically familiar, but the XK0-005 exam emphasizes modern tools like `ss` over deprecated commands.
How to eliminate wrong answers
Option A is wrong because `lsof -i TCP` lists all open files associated with TCP connections, including non-listening sockets, and does not filter to only listening ports without additional flags. Option B is wrong because `netstat -tulpn` is a legacy command that may not be installed by default on modern systems and is deprecated in favor of `ss`; while it would show listening TCP ports, it is not the best or recommended command. Option D is wrong because `nmap -sT localhost` performs a TCP connect scan against the local host, which is a network scanning tool used for security auditing, not a standard system administration command to view listening ports and processes.
A Linux administrator needs to locate all files in the /var directory that have been modified within the last 30 minutes and are larger than 10MB. Which command accomplishes this task?
Correct: -mmin -30 matches files modified less than 30 minutes ago, and -size +10M matches files larger than 10MB.
Why this answer
The find command with -mmin and -size options can locate files based on modification time and size. -mmin -30 finds files modified less than 30 minutes ago, and -size +10M finds files larger than 10MB.
A server is experiencing intermittent network connectivity issues. The administrator wants to run a continuous test that combines ping and traceroute to monitor the path and packet loss to a target host. Which command should be used?
mtr continuously displays the route and packet loss per hop.
Why this answer
mtr combines ping and traceroute functionality, continuously showing each hop and packet loss statistics.
A Linux administrator needs to configure auditing to monitor changes to the /etc/passwd file. Which auditctl command should be used?
Correct. The -w flag watches a file, -p wa specifies permissions to monitor (write and attribute change), and -k adds a key for filtering. This is the standard auditctl command for file change monitoring.
Why this answer
The correct command is option B. It uses the -w watch syntax to monitor /etc/passwd for write (w) and attribute change (a) permissions, which is the standard and simplest method for auditing changes. Option D is a valid syscall-based alternative but is more complex and not the best answer for this question.
Option A includes read permission, which is unnecessary. Option C monitors unlink and rename syscalls, not direct file modifications.
A Linux administrator is troubleshooting a DNS resolution issue. The system uses /etc/resolv.conf. Which two of the following directives are commonly found in this file? (Choose two.)
nameserver specifies a DNS server.
Why this answer
/etc/resolv.conf typically contains nameserver entries and optionally search and domain directives.
Which three directories are required by the FHS to be present on a Linux system? (Select THREE.)
Essential user binaries.
Why this answer
/bin, /etc, and /dev are essential FHS directories. /opt is optional, /proc is a virtual filesystem, /mnt is for temporary mounts but not always present.
A Linux administrator needs to locate all files in the /etc directory that have been modified in the last 24 hours and are not owned by root. Which two commands can be combined to achieve this? (Select TWO.)
Correct: finds files modified in last 24 hours not owned by root.
Why this answer
find with -mtime 0 finds files modified in the last 24 hours; -not -user root excludes root-owned files. The -exec option executes ls -l to list details.
An administrator adds a new disk /dev/sdc1 and wants it mounted at /mnt/backup at every boot. Based on the exhibit, which line should be added to /etc/fstab?
Correct format with UUID.
Why this answer
/etc/fstab entries should use UUIDs for persistent device identification, and the mount point must exactly match the intended directory /mnt/backup. The 'defaults' option and '0 0' (no dump, no fsck) are appropriate for a non-root filesystem that does not require boot-time checking.
Exam trap
CompTIA Linux+ often tests the requirement to use UUIDs in /etc/fstab for persistent mounts, and the trap here is that candidates may incorrectly choose a device path option (like /dev/sdc1) or a wrong mount point, overlooking the need for exact directory matching and proper fsck values.
How to eliminate wrong answers
Option A is wrong because the mount point is listed as '/backup' instead of '/mnt/backup', which does not match the requirement. Option B is wrong because it uses 'nofail' instead of 'defaults', which is not a standard fstab option and would not ensure the filesystem is mounted at boot. Option C is wrong because it uses the device path '/dev/sdc1' instead of a UUID, which can change between reboots, and the fsck pass value '2' is unnecessary for a non-root filesystem.
Option D is wrong because it uses the device path '/dev/sdc1' instead of a UUID, risking mount failures if the device name changes.
A server is secured with SELinux in enforcing mode. A custom web application needs to write logs to /var/log/webapp. The SELinux type for httpd is httpd_t. Which command sets the correct context for the log directory?
This adds a persistent rule and applies the correct type for log files.
Why this answer
It uses `semanage fcontext` to add a persistent file context rule that assigns the `httpd_log_t` type to the `/var/log/webapp` directory and its contents, then applies it with `restorecon`. The `httpd_log_t` type is specifically designed for log files written by the httpd process, allowing Apache (running as `httpd_t`) to write logs while maintaining SELinux enforcement.
Exam trap
The trap here is that candidates confuse process domains (like `httpd_t`) with file types (like `httpd_log_t`) or mistakenly use `chcon` for a permanent context change, not realizing that `semanage fcontext` with `restorecon` is required for persistent labeling in enforcing mode.
How to eliminate wrong answers
Option B is wrong because `httpd_sys_content_t` is intended for static web content (e.g., HTML, scripts) served by httpd, not for log files; using it would not grant the necessary write permissions for logging and could cause AVC denials. Option C is wrong because `httpd_enable_homedirs` is a boolean that controls access to user home directories, not log directory labeling; it does not set any file context. Option D is wrong because `httpd_t` is a process domain type, not a file type; assigning a process type to a directory would break SELinux labeling and prevent proper access.
The company password policy requires minimum length, complexity, and that passwords cannot be based on dictionary words. Which file should be edited to configure these settings via pam_pwquality?
This file contains the pam_pwquality parameters such as minlen, dcredit, ucredit, ocredit, and lcredit.
Why this answer
The pam_pwquality module enforces password quality rules such as minimum length, complexity, and dictionary checks. Its configuration file is /etc/security/pwquality.conf, where parameters like minlen, dcredit, ucredit, lcredit, ocredit, and dictcheck are set. Editing this file directly controls the PAM module's behavior without modifying PAM service files.
Exam trap
The trap here is that candidates confuse the PAM service file (which invokes the module) with the module's configuration file, leading them to choose /etc/pam.d/system-auth or /etc/pam.d/password-auth instead of /etc/security/pwquality.conf.
How to eliminate wrong answers
Option B is wrong because /etc/login.defs controls shadow password suite parameters (e.g., PASS_MAX_DAYS, PASS_MIN_LEN) but does not configure pam_pwquality settings. Option C is wrong because /etc/pam.d/system-auth is a PAM service file that includes pam_pwquality via a 'password requisite pam_pwquality.so' line, but it does not contain the configuration parameters themselves. Option D is wrong because /etc/pam.d/password-auth is another PAM service file (often used for non-system logins) that similarly invokes pam_pwquality but is not the configuration file for its settings.
Which TWO are standard methods to boot into rescue mode in a systemd-based Linux distribution?
Immediately switches the system to rescue.target.
Why this answer
`systemctl rescue` directly activates the `rescue.target`, which is the standard systemd mechanism to boot into a single-user, minimal rescue environment. This target mounts essential filesystems and starts basic services, providing a shell for troubleshooting without a full multi-user boot.
Exam trap
The trap here is that candidates confuse 'rescue mode' with 'emergency mode' or legacy `init=/bin/bash` methods, failing to recognize that systemd defines `rescue.target` as the standard, service-aware rescue environment.
Which command displays real-time information about running processes, including CPU and memory usage, and updates the display dynamically?
top provides real-time dynamic process information.
Why this answer
top displays a dynamic real-time view of running processes and system resource usage.
An administrator uses Podman containers and wants them to start automatically when the host boots. Which method should be used?
This creates systemd unit files and enables them for automatic startup.
Why this answer
Podman does not have a built-in auto-start mechanism; instead, it integrates with systemd by generating a systemd service unit file using `podman generate systemd --new --files`. This creates a service that manages the container as a transient unit, and then `systemctl enable` makes it start automatically at boot. This approach leverages systemd's dependency-based boot sequencing and ensures the container is restarted if it fails.
Exam trap
The trap here is that candidates may assume Podman has a simple built-in auto-start toggle like Docker's `--restart always` flag, but Podman requires explicit systemd integration for boot-time startup, and the exam tests knowledge of the correct command sequence (`generate systemd` followed by `systemctl enable`).
How to eliminate wrong answers
Option A is wrong because `podman auto-start on` is not a valid Podman command; Podman does not have a native auto-start feature. Option C is wrong because `podman register-service` is not a real Podman subcommand; Podman uses systemd integration, not a separate registration command. Option D is wrong because while `/etc/rc.local` can start containers, it is a legacy method that lacks systemd's dependency management, restart policies, and logging, making it unreliable for production container management.
A Linux administrator needs to view all current IPv4 addresses assigned to network interfaces on a system. Which command should be used?
ip addr shows all IP addresses on interfaces.
Why this answer
The 'ip addr' command displays all IP addresses assigned to network interfaces. 'ifconfig' is deprecated, 'ip link' shows link-layer info, and 'hostname -I' only shows primary IPs.
Practice XK0-006 by domain
Target a specific domain to shore up weak areas.