CompTIA Linux+ (XK0-006) (XK0-006) — Questions 601–675

Since gateway and internal pings succeed, routing and local connectivity work, so the fault likely lies in name resolution or external routing. nslookup google.com queries DNS directly, confirming whether the server can resolve external hostnames before any HTTP attempt.

SELinux confines httpd with the httpd_t domain, which by default denies outbound TCP connections to database ports. Enabling the httpd_can_network_connect boolean permits exactly that outbound network access, resolving the blocked connection to port 3306 without disabling SELinux enforcement.

chmod 640 sets owner read and write (6), group read only (4), and no permissions for others (0). The octal digits map directly onto the required owner, group and other access, satisfying the stated permission set.

The findmnt --verify command checks the syntax of /etc/fstab and other mount configuration files, and verifies that the entries are valid and can be mounted, without actually mounting them. It reports errors and warnings, making it ideal for troubleshooting a suspected incorrect fstab entry that prevents boot.

`less` reads the file lazily and renders it in a scrollable pager, displaying one screenful at a time while allowing forward and backward navigation without loading the whole file into memory. This directly satisfies the requirement to view file contents page by page, unlike `cat`, which dumps everything at once.

getopts is the shell built-in that parses short options, handling flags and their arguments, and exposes each via OPTARG and OPTIND. It satisfies the requirement to process -f filename and -v without external utilities or manual argument shifting.

A crontab entry with fields 0 2 * * * runs the script at exactly 02:00 daily. Cron reads the schedule directly, requires no daemon beyond the standard cron service, and adds no wrapper or timer configuration overhead.

`systemctl enable service` creates the symbolic links in the systemd unit directories that cause the service to be pulled into the boot transaction, satisfying the requirement that it start automatically at boot. It does not start the unit immediately, unlike `systemctl start`, which affects only the current session.

The iptables error shows Docker's DOCKER chain is missing after the update, so the daemon cannot program container port mappings. Restarting the daemon with systemctl rebuilds those iptables chains, restoring the external connectivity the front-end container needs on port 80.

The free -h command reads kernel memory statistics and prints them in human-readable units, directly satisfying the requirement to display both free and used RAM and swap. Its -h flag scales values to MiB or GiB, avoiding raw byte counts that obscure quick interpretation.

This entry grants the group webadmins (denoted by %) passwordless sudo access to run any command as any user on the host web01. The syntax is correct: user/group, host, runas, and command with NOPASSWD tag. It precisely matches the requirement.

nohup makes the process immune to SIGHUP, so it survives the terminal hangup when the user logs out; the trailing & backgrounds it so control returns immediately. Together they satisfy the requirement that the command keep running after logout.

`ps aux` lists every process on the system, not just the invoking user's, satisfying the requirement to include other users' processes. The `a` flag selects processes from all terminals, `u` adds user-oriented detail, and `x` includes processes without a controlling terminal, while the command column shows full command lines.

The `--device` flag maps a specific host device node into the container's namespace, granting direct hardware access without privileged mode. This satisfies the requirement to reach USB drives, whereas `--privileged` would expose all host devices unnecessarily. Passing `/dev/ttyUSB0` gives the container the exact device it needs.

Combines key generation and self-signing in a single invocation: -newkey rsa:2048 creates the 2048-bit RSA private key, -x509 emits a self-signed certificate rather than a CSR, -days 365 sets validity, and -nodes omits key encryption.

CMD sets the default command executed when the container starts, but it is overridden when arguments are supplied to docker run. ENTRYPOINT, by contrast, is not overridden this way, so CMD matches the stated requirement.

The -u flag filters journal entries to the sshd unit, while -n 20 limits output to the most recent 20 lines. Together they satisfy the requirement to view the last 20 journal lines for that specific service.

The leading 4 sets the SUID bit, so the program runs with the file owner's privileges rather than the invoking user's. The remaining 755 grants rwx to the owner and r-x to group and others, matching the octal digits exactly. This satisfies the stem's requirement to interpret chmod 4755 correctly.

Editing `/etc/ssh/sshd_config` with `PasswordAuthentication no` disables password logins server-side, satisfying the key-only requirement. This directive governs the sshd daemon's authentication methods, so clients offering passwords are rejected while public-key authentication continues to work. Changes require restarting or reloading the SSH service to take effect.

Writing the module name into /etc/modules-load.d/custom_hw.conf instructs systemd-modules-load.service to load it during early boot, satisfying the automatic-load-at-boot requirement. Unlike /etc/modprobe.d, which only supplies options or blacklists for modules loaded elsewhere, this drop-in directory actively triggers loading, and it works independently of hardware detection.

SELinux denials are logged as AVC messages in the audit log. The ausearch command with -m avc filters specifically for these access vector cache denials, and -ts recent limits output to recent events, directly revealing why the application cannot write to /etc.

g+w adds write permission to the group, leaving other permissions unchanged.

A full root filesystem leaves no free blocks for rsyslog or journald to append entries, so logging silently stalls while other services continue running. The stem's symptom—a system log that has stopped updating—directly matches exhausted disk space on the partition holding /var/log, which is the constraint this option satisfies.

This command queries the fail2ban server for the status of the sshd jail, showing currently banned IPs, total failed attempts, and other statistics. It is the correct way to verify that the jail is active and functioning as intended for SSH protection.

vmstat reports the number of runnable processes in the r column and processes blocked in uninterruptible sleep in the b column. A persistently high r points to CPU saturation, while a high b points to I/O blocking. Sampling every second reveals which condition dominates.

`dmesg` reads the kernel ring buffer directly, exposing hardware and driver messages logged during the current boot. This satisfies the stem's requirement to inspect boot-time hardware errors, unlike journal or log-file tools that may aggregate or filter kernel output.

Setting `crashkernel=auto` reserves memory for the kdump kernel at boot, allowing a secondary kernel to capture the panic dump when the primary one fails. Without this reservation, kdump cannot load, so no vmcore is written. It directly satisfies the requirement to capture the crash dump for analysis.

The -i flag edits the file in place, while the g suffix replaces every occurrence of foo with bar on each line rather than only the first. This satisfies the requirement to change all matches and save changes directly to the configuration file.

Setting the INPUT chain's default policy to DROP denies all inbound traffic, then appending ACCEPT rules for TCP ports 22 and 443 permits only SSH and HTTPS. This satisfies the stem's requirement to allow those two services while denying everything else.

Contains kernel version string.

This entry grants user 'ops' on host 'webserver' permission to run only that exact systemctl restart command as root, with no wildcards or broader command scope. It satisfies the least-privilege constraint by restricting sudo to the single specified command on the specified host.

/etc/shadow stores hashed passwords plus ageing fields such as last change, minimum, maximum and warning days, readable only by root. This satisfies the requirement for a file holding both hashed passwords and password ageing information.

Docker volumes store data outside the container's writable layer, in a host-managed directory, so it persists independently of the container lifecycle. This directly satisfies the requirement that storage survives restarts, unlike bind mounts tied to host paths or data written inside the container, which is destroyed on removal.

setfacl -m invokes modify mode, and the entry u:jdoe:r adds an ACL granting user jdoe read permission on the file without altering the existing owner, group or other bits. This directly satisfies the requirement to add a read ACL entry for that named user.

AllowGroups sshusers restricts SSH logins to members of the sshusers group, satisfying the requirement to limit access by group membership. Unlike AllowUsers, which matches individual accounts, AllowGroups checks the user's supplementary and primary group memberships at authentication, denying all others.

/bin holds essential user command binaries required for booting and single-user repair, such as ls, cp and sh. It is distinct from /sbin, which holds system administration binaries, and /usr/bin, which holds non-essential user commands.

`mount | grep noexec` lists mounted filesystems and filters for the `noexec` mount option. If the filesystem containing the script is mounted with `noexec`, execution is blocked regardless of file permissions. This command directly reveals whether that option is active, explaining the 'Permission denied' error despite the execute bit being set.

Cron runs jobs with a minimal environment and a PATH that usually excludes /usr/local/bin and sometimes /usr/bin. When the script calls tar by name, the command is not found and the job fails silently unless output is captured. Defining PATH in the crontab or using absolute paths like /usr/bin/tar ensures the commands resolve, matching the manual-versus-cron discrepancy.

Top displays real-time CPU and memory usage along with processes.

Disables password logins, reducing risk of brute force.

Ansible is an agentless automation tool that uses an inventory of hosts and modules such as copy to push files to many servers simultaneously. An ad-hoc command like ansible all -m copy -a 'src=... dest=...' runs against all inventory hosts in parallel and reports per-host results, matching the requirement exactly.

Editing /etc/fstab adds the noexec mount option to the /tmp entry, so systemd applies it automatically at every boot. This satisfies the requirement to persist the setting across reboots, unlike a one-off mount command, which would be lost on restart.

A high wa value in vmstat means CPUs are idle while waiting for I/O operations to complete. Low us and sy confirm the processors are not the constraint. This points to slow or overloaded storage, such as a failing disk, saturated array, or heavy write load, which matches the intermittent stalls and makes storage the correct diagnosis.

The when: conditional evaluates the group_names variable, which contains the inventory groups the host belongs to, so the install task runs only on webservers hosts. The notify: directive queues a handler named in the handlers section, and handlers run only when the notifying task reports a changed state. Together they deliver conditional installation plus restart-on-change.

systemctl status httpd reports whether the unit is active, inactive or failed, and systemctl start httpd launches it if inactive. This pairing satisfies the requirement to check current state before conditionally starting the service, using systemd's native unit management.

The kernel cannot locate the root filesystem because the root= parameter points to a wrong or nonexistent device, producing unknown-block(0,0). Correcting the root device specification in the bootloader's kernel command line lets the kernel mount the real root filesystem.

The binary has usr_t context, which is not allowed for execution by the service; restoring to bin_t fixes it.

The pam_sss module works with SSSD to authenticate users. When SSSD is configured with caching (e.g., cache_credentials = True), it stores user credentials locally, allowing offline authentication when the central server is unreachable. This is the standard method for providing cached credentials in modern Linux environments.

The kernel mounts the root filesystem using drivers supplied by the initramfs. If that image is corrupt or omits the storage or filesystem module, the root device cannot be mounted, producing exactly this unknown-block(0,0) panic during boot.

`journalctl -k` reads the kernel ring buffer through systemd's journal, filtering entries to kernel-originated messages only. Because the journal persists per-boot metadata, it can restrict output to the current boot, directly satisfying the requirement to inspect kernel messages from the present boot rather than earlier ones.

The ip -s link show command displays interface statistics, including RX/TX errors, dropped packets, and overruns. By specifying eth0, the administrator can see detailed counters that indicate whether the interface is experiencing errors or discards, which could explain dropped SSH sessions. This directly addresses the need to inspect error and discard statistics for a specific interface.

`chcon -t httpd_sys_content_t` directly relabels the file's SELinux type to `httpd_sys_content_t`, satisfying the stem's requirement to temporarily set a context matching the application's expected type. Unlike `semanage fcontext`, which writes persistent mapping rules, `chcon` changes only the live label, so the change is lost on relabelling.

Uncommenting `%wheel ALL=(ALL) ALL` in /etc/sudoers grants the wheel group password-prompted sudo rights to run any command as any user, satisfying the "any command" requirement. Editing via visudo validates syntax before saving, preventing a corrupted sudoers file that would lock out all sudo access.

The sticky bit restricts deletion or renaming of files within /tmp so only each file's owner, the directory owner or root may remove them. This mitigates the world-writable risk without removing write access that applications legitimately require.

The nofail option tells systemd that the mount is not required for boot. If the device is missing or the mount fails, the boot process continues without entering emergency mode. This directly addresses the requirement to avoid emergency mode while still attempting the mount.

lsof +L1 lists all open files that have a link count less than 1, which indicates deleted files still held open by a process. This directly identifies the process preventing space from being reclaimed, allowing the administrator to restart or kill it to free the space. It is the precise tool for this scenario.

Chef enforces desired state through declarative recipes and cookbooks, converging nodes via its agent and Chef Server. This satisfies the stem's configuration management requirement by automating consistent package, file and service configuration across fleets, rather than merely provisioning infrastructure or orchestrating containers like other tools.

journalctl -u filters the journal by the specified systemd unit, showing all log entries for that service. This is the most direct way to see why the service failed. It includes messages from the service's startup, errors, and dependencies, making it ideal for troubleshooting a failed start.

The `-x509` flag makes `req` emit a self-signed certificate rather than a certificate signing request, while `-newkey rsa:2048` generates the private key alongside it. `-keyout` and `-out` write both files in a single invocation, satisfying the requirement to create certificate and key together.

The `-size +100M` predicate filters on file size in mebibytes, while `-name '*.log'` matches the extension, and the starting point `.` recurses the current directory tree. Both constraints from the stem are satisfied in a single pass, with no piping required.

PasswordAuthentication no forces public-key authentication, and AllowUsers alice bob permits bob, so bob can log in with a public key. PermitRootLogin no blocks root, and MaxAuthTries 2 limits attempts, but neither prevents bob's key-based login.

The -r (or --resizefs) option to lvextend resizes the underlying filesystem together with the logical volume, so the root LV and its filesystem are extended in a single command. Using -l +100%FREE allocates all remaining free extents in the volume group. This is the correct and efficient way to grow the LV and filesystem without a separate resize2fs or xfs_growfs step.

The || operator runs the right-hand command only when the left-hand command returns a non-zero exit status. This allows the script to log the failure for a duplicate username and continue with the next iteration, which matches the requirement to keep processing remaining users without aborting the entire script.

`zcat` streams decompressed data from gzip-compressed files straight to standard output, leaving the original archive untouched on disk. This satisfies the stem's constraint of reading a compressed log's contents without decompressing it, since no extracted file is written. It also handles `.gz` logs directly, unlike `cat`, which would emit raw binary.

less displays file contents one screenful at a time, supporting forward and backward scrolling plus in-page searching. It satisfies the paging requirement directly, unlike cat, which dumps the entire file to standard output without pagination.

Can cause 'No such file or directory'.

This command both enables the unit to start at boot by creating the appropriate symlinks and starts it immediately. The --now flag is the standard systemd way to combine enable and start in one step. It satisfies the requirement to start automatically at boot and to start the service right away without rebooting.

systemd parses unit files strictly; an invalid directive, malformed section header or bad value causes the loader to reject the unit with 'Invalid argument' before execution. A syntax error in the file under /etc/systemd/system therefore prevents the unit from loading at all, matching the reported error.

The trailing plus sign in the permission string signals that an extended ACL is attached to the file. getfacl reads and displays those access control entries, including named users, groups and masks, which ls does not show. This directly satisfies the requirement to view current ACL entries.

audit2allow reads SELinux denial records from the audit log and generates allow rules targeting the exact permissions the service was refused. This produces the minimum policy change needed, rather than disabling enforcement or granting broad access, directly satisfying the requirement to suggest least-privilege policy adjustments.

systemctl daemon-reload reloads the systemd manager configuration, including unit files. After modifying a unit file, this command is necessary for systemd to recognize changes. It does not restart services but ensures the new configuration is loaded before attempting to restart the service.

The '*.* @192.168.1.100:514' rule forwards whatever syslog receives, but Apache writes access logs to files by default, not to syslog. Configuring the LogFormat directive with the syslog facility makes Apache emit entries into syslog, which rsyslog then forwards.

`journalctl -u myservice -b` filters the journal for messages from the specified unit and limits output to the current boot. This shows all log entries for the service since the last boot, which is exactly what the administrator needs to diagnose why the service failed to start at boot.