39 free CompTIA Linux+ XK0-006 practice questions from the CertStash pack of 155, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 39 free here, all 155 in the pack, and each step includes the one before it.
Get all 155 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A Linux administrator needs to create and then connect to the app-01-image container. Which of the following commands accomplishes this task?
Show answer and explanation
Correct answer: A. docker run -it app-01-image
The `docker run -it app-01-image` command creates a new container from the specified image and connects to it interactively. The `-i` flag keeps STDIN open even if not attached, and `-t` allocates a pseudo-terminal, allowing the administrator to interact with the running container immediately.
Why the other options are wrong
- B. docker start is used to start an existing stopped container, not create a new one from an image.
- C. docker build is used to build images from a Dockerfile, not create or connect to containers.
- D. docker exec runs commands in an already-running container; it cannot be used to initially create and connect to a container.
Question 2
To perform a live migration, which of the following must match on both host servers? (Choose two).
Show answer and explanation
Correct answer: D, F. CPU architecture; Disk storage path
Live migration moves a running VM between hosts, so both hosts must have compatible CPU architecture for the guest to keep executing the same instructions. The VM's disks must also be reachable at the same storage path on both hosts, typically shared storage, so the destination can open the same disk images. Resources such as memory only need to be sufficient, not identical.
Why the other options are wrong
- A. USB ports are peripheral hardware and do not need to match for a live migration.
- B. Network speed affects how quickly the migration completes but does not have to be identical on both hosts.
- C. Available swap is a host-local resource and does not need to match between hosts.
- E. The destination only needs enough free memory for the VM, the amount of available memory does not have to match.
Question 3
A Linux systems administrator needs to extract the contents of a file named /home/dev/web.bkp to the /var/www/html/ directory. Which of the following commands should the administrator use?
Show answer and explanation
Correct answer: A. cd /var/www/html/ && gzip -c /home/dev/web.bkp | tar xf -
The command `cd /var/www/html/ && gzip -c /home/dev/web.bkp | tar xf -` changes to the target directory and then extracts the compressed backup file there. The `-c` flag for gzip decompresses to stdout, which is piped to `tar xf -` to extract from stdin, with `-x` extracting and `-f -` reading from stdin.
Why the other options are wrong
- B. The syntax uses `$$` which is invalid (should be `;`), and cpio requires different input format than a .bkp file would typically provide.
- C. This command uses tar with `-c` (create) mode instead of extract mode, and specifies the wrong paths, effectively creating an archive rather than extracting.
- D. unzip is for ZIP archives, not .bkp files; the syntax is also incorrect for extraction to a directory.
Question 4
Which of the following Ansible components contains a list of hosts and host groups?
Show answer and explanation
Correct answer: B. Inventory
An Ansible Inventory is the component that contains the list of hosts and host groups that Ansible will manage. It can be a static file (like /etc/ansible/hosts) or dynamically generated, and organizes target systems into groups for orchestration.
Why the other options are wrong
- A. Facts are system information gathered from hosts during playbook execution, not a listing of hosts themselves.
- C. Playbooks are YAML files containing tasks and plays to execute on hosts, not the inventory of hosts.
- D. Collections are organized groupings of Ansible content like roles, modules, and plugins, not host listings.
Question 5
Which of the following filesystems contains non-persistent or volatile data?
Show answer and explanation
Correct answer: C. /proc
The /proc filesystem is a virtual filesystem containing non-persistent, volatile data about running processes and kernel information. It is generated dynamically at boot and resides entirely in RAM, disappearing when the system reboots.
Why the other options are wrong
- A. /boot contains persistent kernel and bootloader files essential for system startup.
- B. /usr contains persistent user applications, libraries, and documentation.
- D. /var contains persistent variable data like logs, mail, and databases, though some subdirectories may have volatile content.
Question 6
An administrator needs to verify the user ID, home directory, and assigned shell for the user named “accounting.” Which of the following commands should the administrator use to retrieve this information?
Show answer and explanation
Correct answer: A. qetent passwd accounting
The `getent passwd accounting` command (note: the question shows 'qetent' which appears to be a typo for 'getent') retrieves user information from the passwd database, displaying the user ID (UID), home directory, and assigned shell for the specified user in a single output line.
Why the other options are wrong
- B. The `id` command displays UID, GID, and group memberships, but not the home directory or shell information.
- C. The /etc/shadow file contains password hashes and expiration information, not user ID, home directory, or shell assignments.
- D. The `who` command shows currently logged-in users, not detailed user account configuration like UID, home directory, or shell.
Question 7
A Linux user needs to download the latest Debian image from a Docker repository. Which of the following commands makes this task possible?
Show answer and explanation
Correct answer: B. docker image pull Debian
The `docker image pull Debian` command downloads the latest Debian image from the default Docker repository (Docker Hub) to the local system. The `pull` subcommand is the correct operation for fetching images from remote repositories.
Why the other options are wrong
- A. docker image init is not a valid Docker command for downloading images.
- C. docker image import is used to import images from tar archives or containers, not to pull from repositories.
- D. docker image save exports existing local images to tar files; it does not download images from repositories.
Question 8
In the echo "profile-$num-$name" line of a shell script, the variable $num seems to not be expanding during execution. Which of the following notations ensures the value is expanded?
Show answer and explanation
Correct answer: D. echo "profile-${num}-$name"
The `${num}` notation uses braces to explicitly delimit the variable name, ensuring proper expansion even when followed by characters that could be mistaken as part of the variable name. This is the correct solution when variable expansion is not working as expected in double-quoted strings.
Why the other options are wrong
- A. Parentheses without a dollar sign like $(num) attempt command substitution, not variable expansion.
- B. Single quotes prevent all variable expansion; the variable will not be expanded in single-quoted strings.
- C. Mixing single and double quotes in this pattern creates literal characters rather than enabling proper variable expansion.
Question 9
A systems administrator wants to review the logs from an Apache 2 error.log file in real time and save the information to another file for later review. Which of the following commands should the administrator use?
Show answer and explanation
Correct answer: D. tail -f /var/log/apache2/error.log | tee logfile.txt
The `tee` command reads from stdin and writes to both stdout and a file simultaneously, allowing real-time viewing while saving to a file. Option A uses `>` which overwrites and doesn't display in real-time. Option B uses a pipe to a filename which is invalid syntax. Option C uses `>>` which appends but doesn't display output in real-time to the terminal.
Why the other options are wrong
- A. The `>` operator redirects only to file without displaying output to the terminal in real-time.
- B. Piping to a filename is invalid syntax; a command must follow the pipe operator.
- C. The `>>` operator appends to file but doesn't display the output on the terminal simultaneously.
Question 10
Which of the following describes the method of consolidating system events to a single location?
Show answer and explanation
Correct answer: A. Log aggregation
Log aggregation is the practice of collecting and consolidating system logs from multiple sources into a single centralized location for easier monitoring and analysis. Health checks monitor system status but don't consolidate logs. Webhooks are event-driven notifications. Threshold monitoring alerts when metrics exceed set limits.
Why the other options are wrong
- B. Health checks verify system availability and status but don't consolidate logs to a single location.
- C. Webhooks are callbacks for event notifications, not log consolidation mechanisms.
- D. Threshold monitoring alerts when values exceed limits but is not about consolidating system events.
What people say about the full XK0-006 pack 4.9 from 8
Valid dumps for the CompTIA XK0-006 exam. Tried and tested. Got a score of 91%. Thank you Cert Stash. Keep posting amazing stuff.
Passed. Studying from this pdf actually works. First attempt I only used official material and failed. The difference was very noticeable. Should have used it from the start.
Great resource for this cert. Failed my first attempt. Got this dump, went through it and passed easily.
Question 11
Which of the following commands should a Linux administrator use to determine the version of a kernel module?
Show answer and explanation
Correct answer: D. modinfo bluetooth
The modinfo command displays detailed information about a kernel module, including version, license, author, description, and dependencies. It queries the module metadata directly. Option A (modprobe) loads or unloads kernel modules but doesn't display version information. Option B (lsmod) lists currently loaded modules but provides minimal information and cannot target unloaded modules. Option C (depmod) analyzes kernel module dependencies but doesn't display module version details.
Why the other options are wrong
- A. modprobe is used to load or remove kernel modules, not to query their version information.
- B. lsmod lists loaded modules but does not provide detailed version or metadata information.
- C. depmod generates module dependency information, not version details about specific modules.
Question 12
Which of the following commands should an administrator use to convert a KVM disk file to a different format?
Show answer and explanation
Correct answer: D. qemu-img
The qemu-img command is the standard tool for managing QEMU/KVM disk images, including converting between different formats (raw, qcow2, vmdk, vdi, etc.). It provides options like 'convert' to transform disk images from one format to another. Option A (qemu-kvm) is the hypervisor itself, not a management tool. Option B (qemu-ng) does not exist as a standard QEMU tool. Option C (qemu-io) is used for low-level disk I/O testing and debugging, not format conversion.
Why the other options are wrong
- A. qemu-kvm is the hypervisor executable for running virtual machines, not for managing disk images.
- B. qemu-ng is not a standard QEMU utility for disk image management.
- C. qemu-io is a diagnostic tool for disk I/O operations, not for converting image formats.
Question 13
A Linux administrator wants to use AI to deploy infrastructure as code. Which of the following is a best practice regarding the use of AI for this task?
Show answer and explanation
Correct answer: C. Linting generated code
Linting generated code is a best practice when using AI to generate infrastructure-as-code. Linters check code for syntax errors, style violations, and potential bugs before deployment, ensuring quality and security. This validates and improves AI-generated code before it enters production.
Why the other options are wrong
- A. Copy and paste of AI-generated code without review or modification is a poor practice that can introduce errors and security vulnerabilities.
- B. Generating monolithic code blocks is not a best practice; modular, smaller code units are preferable for maintainability.
- D. Merging CI/CD pipelines is not a specific best practice related to using AI for infrastructure-as-code generation.
Question 14
A Linux administrator wants to add a user to the Docker group without changing their primary group. Which of the following commands should the administrator use to complete this task?
Show answer and explanation
Correct answer: C. sudo usermod -aG docker user
The `usermod -aG docker user` command appends the user to the docker group as a supplementary group without changing the primary group. The `-a` flag is essential to append rather than replace groups. Option A uses groupmod instead of usermod. Option B uses `-g` which changes the primary group. Option D uses groupmod which doesn't add users to groups.
Why the other options are wrong
- A. The `groupmod` command modifies group properties but doesn't add users to groups.
- B. The `-g` flag changes the primary group, which violates the requirement to keep it unchanged.
- D. The `groupmod` command cannot add users to groups; it only modifies group properties.
Question 15
A Linux administrator needs to securely erase the contents of a hard disk. Which of the following commands is the best for this task?
Show answer and explanation
Correct answer: B. sudo shred /dev/sda1
The shred command securely erases file data by overwriting it multiple times before deletion, making it difficult or impossible to recover. When used on a disk device, it performs secure erasure suitable for sensitive data destruction in forensic scenarios.
Why the other options are wrong
- A. rm -rf does not securely erase data; deleted files can still be recovered from disk.
- C. parted is a partition management tool; the rm subcommand removes partitions but does not securely erase disk contents.
- D. dd with /dev/null creates zeros on the disk but does not provide the secure overwriting that shred does.
Question 16
Which of the following best describes the role of initrd?
Show answer and explanation
Correct answer: B. It contains basic kernel modules and drivers required to start the system.
The initrd (initial RAM disk) contains the basic kernel modules and drivers required to start the Linux system, particularly drivers needed to access the root filesystem. It is loaded by the bootloader early in the boot process and provides essential functionality before the real root filesystem is mounted.
Why the other options are wrong
- A. SSH connectivity is not related to initrd; SSH is configured after the system is fully booted.
- C. Certificates and keys are stored in the filesystem, not in initrd.
- D. While the kernel may initialize random devices, that is not the primary role of initrd.
Question 17
A Linux administrator needs to analyze a compromised disk for traces of malware. To complete the analysis, the administrator wants to make an exact, block-level copy of the disk. Which of the following commands accomplishes this task?
Show answer and explanation
Correct answer: D. dd if=/dev/sdc of=/tmp/image bs=8192
The dd command with the specified parameters (if=/dev/sdc of=/tmp/image bs=8192) creates an exact, bit-for-bit block-level copy of the entire disk. The bs parameter sets the block size for efficient copying, making this the proper forensic imaging approach that preserves all data including unallocated space.
Why the other options are wrong
- A. cp -rp copies files and directories but not at the block level; it cannot create a forensic image of an entire disk.
- B. cpio is an archive tool designed for file-level copying, not for creating block-level disk images.
- C. tar creates compressed archives of files and directories, not block-level forensic images of raw disk devices.
Question 18
A Linux administrator wants to make the ENABLE_AUTH variable set to 1 and available to the environment of subsequently executed commands. Which of the following should the administrator use for this task?
Show answer and explanation
Correct answer: D. export ENABLE_AUTH=1
The export command makes a variable available to the environment of child processes. Using export ENABLE_AUTH=1 both sets the variable to 1 and exports it so that any subsequently executed commands (child processes) can access this variable. This is the standard and correct syntax.
Why the other options are wrong
- A. let ENABLE_AUTH=1 is used for arithmetic operations in bash and does not export the variable to the environment.
- B. ENABLE_AUTH=1 sets the variable only in the current shell but does not export it to child processes' environments.
- C. ENABLE_AUTH=$(echo $ENABLE_AUTH) would set ENABLE_AUTH to its current value (or empty if unset) without exporting it, and doesn't set it to 1.
Question 19
Which of the following most accurately describes a webhook?
Show answer and explanation
Correct answer: D. An HTTP-based callback function
A webhook is an HTTP-based callback mechanism that allows a system to send real-time data to another system when specific events occur. It is essentially a user-defined HTTP callback that delivers event information automatically, enabling event-driven automation and integration between web services.
Why the other options are wrong
- A. Webhooks are not an authentication method; they are event notification mechanisms that typically work with existing authentication schemes.
- B. Webhooks are not SNMP-based; SNMP is a separate protocol for network management that webhooks do not use.
- C. While webhooks can transmit sensitive data, their defining characteristic is the callback mechanism, not data sensitivity.
Question 20
Users cannot access an application that is running inside containers. The administrator wants to validate whether the containers are running. Which of the following commands should the administrator use?
Show answer and explanation
Correct answer: B. docker ps
The docker ps command lists all running containers, making it the appropriate tool to validate whether containers are currently active. It displays container ID, image, status, ports, and other metadata. Option A (docker start) starts a stopped container rather than checking status. Option C (docker run) creates and runs a new container, not checking existing ones. Option D (docker images) lists available images, not running container status.
Why the other options are wrong
- A. docker start is used to start a stopped container, not to check whether containers are running.
- C. docker run creates and executes a new container instance, not for checking existing container status.
- D. docker images displays locally available container images, not information about running containers.
Question 21
An administrator must secure an account for a user who is going on extended leave. Which of the following steps should the administrator take? (Choose two).
Show answer and explanation
Correct answer: D, F. Run the command passwd -l user; Change the user’s shell to /sbin/nologin.
passwd -l user locks the user account by disabling the password, preventing login. Changing the user's shell to /sbin/nologin further restricts access by preventing shell login even if other authentication methods existed. Together, these two steps effectively secure an account during extended absence.
Why the other options are wrong
- A. Setting files to immutable protects against modification but doesn't prevent account access or login.
- B. Instructing weekly logins contradicts the goal of securing an account during extended leave.
- C. Deleting the user's /home folder is destructive and unnecessary; the account should remain securable for return.
- E. Changing folder dates has no security effect and doesn't prevent account access.
Question 22
Which of the following passwords is the most complex?
Show answer and explanation
Correct answer: C. H3s@1dSh3t0|d
H3s@1dSh3t0|d is the most complex because it includes uppercase letters (H, S), lowercase letters (s, d, h, t), numbers (3, 1, 0), and special characters (@, |). A complex password requires multiple character types from different categories. This password has 13 characters and uses all four character type categories.
Why the other options are wrong
- A. H3sa1dt01d contains only uppercase, lowercase, and numbers (missing special characters), making it less complex.
- B. he$@ID$heTold contains lowercase, uppercase, and special characters but only uses two numbers, with fewer total character types represented.
- D. HeSaidShetold uses only letters (uppercase and lowercase), lacking both numbers and special characters, making it the least complex option.
Question 23
Which of the following commands should an administrator use to see a full hardware inventory of a Linux system?
Show answer and explanation
Correct answer: A. dmidecode
The dmidecode command reads and displays the system's DMI (Desktop Management Interface) information, providing a comprehensive hardware inventory including BIOS, motherboard, CPU, memory, and other hardware components in a human-readable format.
Why the other options are wrong
- B. lsmod displays loaded kernel modules, not hardware inventory.
- C. dmesg shows kernel log messages and boot information, not a complete hardware inventory.
- D. lscpu displays only CPU information, not a full hardware inventory of the entire system.
Question 24
A Linux administrator is updating the group membership by executing the following commands: However, the group membership is not changing. Which of the following explains this issue?
Show answer and explanation
Correct answer: C. The command groups was run with sudo privileges.
The issue is that the `groups` command was executed with sudo privileges. Under sudo, `groups` runs as root, so it shows root's groups, not admin's. The `whoami` output shows the user is 'admin', but `sudo groups` displays only root. The usermod command with `-aG` is correct and adds the user to the wheel group. To verify the change, run `groups admin` or `id admin`, which name the user. Plain `groups` reports the current process, so admin sees wheel there only after logging in again.
Why the other options are wrong
- A. usermod with sudo is permitted and necessary when modifying other users' group memberships.
- B. Users can absolutely be added to the wheel group using usermod; this is a standard administrative task.
- D. The options are correctly ordered; `-aG wheel admin` correctly appends the wheel group to the admin user.
Question 25
An administrator needs to remove the directory /home/user1/data and all of its contents. Which of the following commands should the administrator use?
Show answer and explanation
Correct answer: C. rm -r /home/user1/data
The rm -r command removes a directory and all of its contents recursively. The -r (or -R) flag is essential for deleting non-empty directories and everything within them. This is the standard and correct approach for removing a directory tree. Option A (rmdir -p) only removes empty directories in a parent-child chain, not directories with contents. Option B (ln -d) is not a valid deletion command; ln creates symbolic links. Option D (cut -d) is a text processing utility for field extraction, not for file deletion.
Why the other options are wrong
- A. rmdir only removes empty directories; it will fail on /home/user1/data if it contains files.
- B. ln -d is not a valid command for directory deletion; ln is for creating links.
- D. cut -d is a text processing tool for parsing fields in data, not for file system operations.
Question 26
A Linux user frequently tests shell scripts located in the /home/user/scripts directory. Which of the following commands allows the user to run the program by invoking only the script name?
Show answer and explanation
Correct answer: C. export PATH=$PATH:/home/user/scripts
The PATH environment variable controls which directories the shell searches for executable programs. By appending /home/user/scripts to PATH using export PATH=$PATH:/home/user/scripts, the user can run scripts from that directory by name alone without specifying the full path. This is the standard method for making custom scripts directly executable.
Why the other options are wrong
- A. SHELL variable specifies the default shell, not the directory search path for executables.
- B. TERM variable specifies terminal type for display, not executable search paths.
- D. The alias command syntax is incorrect and aliases are not the proper mechanism for directory-based executable access.
Question 27
Which of the following is a characteristic of Python 3?
Show answer and explanation
Correct answer: B. It is extensible through modules.
Python 3 is extensible through modules and libraries, allowing developers to add functionality through imports and third-party packages. Python is open source, not closed. It is not fully backwards compatible with Python 2. It is not binary compatible with Java; while it can interface with Java, they are separate runtime environments.
Why the other options are wrong
- A. Python is open source software available for modification and distribution.
- C. Python 3 has significant breaking changes from Python 2, making it not fully backwards compatible.
- D. Python and Java are separate languages with different runtimes; they are not binary compatible with each other.
Question 28
After receiving a monitoring call, an administrator checks the Linux server for processes that have completed execution but have not been removed yet from the process table. Which of the following represents the process state for which the administrator should search?
Show answer and explanation
Correct answer: A. Z
A process that has finished executing but whose entry remains in the process table, because its parent has not yet reaped its exit status with wait(), is a zombie (defunct) process, shown by ps/top with the state code Z. Searching for state Z is exactly how an administrator locates these leftover entries.
Why the other options are wrong
- B. S denotes an interruptible sleep state, meaning the process is alive and waiting for an event or resource, not finished.
- C. D indicates uninterruptible sleep, typically a process blocked on I/O, which is still running and not yet completed.
- D. T means the process is stopped or suspended (e.g., by SIGSTOP or a debugger) and can be resumed, so it has not completed execution.
Question 29
A systems administrator troubleshoots a connectivity issue and needs to determine whether port 449 is open. Which of the following commands should the administrator use?
Show answer and explanation
Correct answer: D. ss -an | grep 449
The command ss -an | grep 449 uses the ss utility to display all network sockets with numeric output, then filters for port 449, allowing verification of whether the port is listening. The ss command is the modern replacement for netstat and provides comprehensive socket statistics. The other options are either syntactically malformed or serve different purposes that don't effectively check port status.
Why the other options are wrong
- A. ip link 449 is syntactically incorrect and the ip link command manages network interfaces, not ports.
- B. dig is a DNS query tool that cannot check port connectivity; the syntax is also incorrect.
- C. tracepath is used for path tracing to a destination, not for checking local port status.
Question 30
A systems administrator manages multiple Linux servers and needs to set up a reliable and secure way to handle the complexity of managing event records on the OS and application levels. Which of the following should the administrator do?
Show answer and explanation
Correct answer: B. Implement a centralized log aggregation solution.
A centralized log aggregation solution is the best approach for managing event records across multiple Linux servers. It provides reliable, secure, and scalable log management by collecting logs from all servers in one place, enabling easier monitoring, analysis, and compliance. This addresses the complexity mentioned in the question by providing a unified view of OS and application events across the infrastructure.
Why the other options are wrong
- A. On-demand log retrieval is reactive rather than proactive and doesn't address the systematic management of event records.
- C. Backing up logs to remote storage helps with retention but doesn't solve the complexity of managing and analyzing logs across multiple servers.
- D. Log rotation only manages individual server logs; it doesn't provide centralized visibility or analysis across the infrastructure.
Question 31
Which of the following is a protocol for accessing distributed directory services containing a hierarchy of users, groups, machines, and organization units?
Show answer and explanation
Correct answer: C. LDAP
LDAP (Lightweight Directory Access Protocol) is the standard protocol for accessing distributed directory services that maintain hierarchical information about users, groups, machines, and organizational units. It is widely used in enterprise environments for centralized identity and access management.
Why the other options are wrong
- A. SMB is a file sharing protocol used for network file access, not directory services.
- B. TLS is a cryptographic protocol for secure communication, not a directory service protocol.
- D. KRB-5 (Kerberos) is an authentication protocol, not a directory service protocol for organizing hierarchical information.
Question 32
An administrator attempts to install updates on a Linux system but receives error messages regarding a specific repository. Which of the following commands should the administrator use to verify that the repository is installed and enabled?
Show answer and explanation
Correct answer: D. yum repolist all
The command yum repolist all displays all configured repositories along with their status (enabled or disabled), allowing administrators to verify repository configuration and troubleshoot repository-related installation issues. This is the standard command for inspecting repository setup on yum-based systems.
Why the other options are wrong
- A. yum repo-pkgs is used to list packages within a specific repository, not to verify repository installation or status.
- B. yum list installed repos is not a valid yum command for viewing repository status.
- C. yum reposync is used to synchronize packages from repositories, not to display repository configuration.
Question 33
A systems administrator is configuring new Linux systems and needs to enable passwordless authentication between two of the servers. Which of the following commands should the administrator use?
Show answer and explanation
Correct answer: A. ssh-keygen -t rsa $$ ssh-copy-id -i ~/.ssh/id_rsa.pub john@server2
The correct process is first generating an RSA key pair with `ssh-keygen -t rsa`, then copying the public key to the remote server with `ssh-copy-id -i ~/.ssh/id_rsa.pub user@server`. Option B uses wrong commands (ssh-keyscan and incorrect key path). Option C misuses ssh-agent. Option D uses ssh-add and scp incorrectly for this purpose.
Why the other options are wrong
- B. The `ssh-keyscan` command is for host key verification, and the syntax and key path are incorrect.
- C. The `ssh-agent` command manages keys but isn't used with `-i` flag in this manner for initial setup.
- D. The `ssh-add` command loads keys into the agent, and `scp` shouldn't be used to copy the .ssh directory.
Question 34
A systems administrator needs to enable routing of IP packets between network interfaces. Which of the following kernel parameters should the administrator change?
Show answer and explanation
Correct answer: D. net.ipv4.ip_forward
net.ipv4.ip_forward is the kernel parameter that controls whether the system forwards IP packets between network interfaces. Setting this to 1 enables routing capability. ip_multicast manages multicast addresses, ip_route is not a standard parameter, and ip_local_port_range defines the range of ports for outbound connections.
Why the other options are wrong
- A. net.ipv4.ip_multicast controls multicast behavior, not IP packet routing between interfaces.
- B. net.ipv4.ip_route is not a standard kernel parameter for enabling packet forwarding.
- C. net.ipv4.ip_local_port_range defines the range of ephemeral ports, not IP forwarding.
Question 35
A systems administrator wants to review the amount of time the NetworkManager service took to start. Which of the following commands accomplishes this goal?
Show answer and explanation
Correct answer: D. systemd-analyze blame
systemd-analyze blame displays startup times for each service in descending order, allowing the administrator to see exactly how long NetworkManager took to start. resolvectl manages DNS settings, journalctl reviews logs without timing data, and systemctl daemon-reload reloads unit files without showing timing analysis.
Why the other options are wrong
- A. resolvectl is used to query and configure DNS resolution settings, not to measure service startup times.
- B. journalctl displays service logs but does not provide startup timing analysis.
- C. systemctl daemon-reload reloads configuration files but does not display service startup duration information.
Question 36
An administrator receives the following output while attempting to unmount a filesystem: umount /data1: target is busy. Which of the following commands should the administrator run next to determine why the filesystem is busy?
Show answer and explanation
Correct answer: D. lsof | grep /data1
lsof (list open files) with grep filtering shows which processes have files or directories open within /data1. When a filesystem is busy, it's typically because one or more processes have open file handles or working directories there. This command directly identifies what's keeping the filesystem in use.
Why the other options are wrong
- A. ps -f /data1 is invalid syntax; ps does not accept filesystem paths as arguments.
- B. du -sh /data1 shows disk usage but doesn't identify which processes are actively using the filesystem.
- C. top -d /data1 is invalid syntax; the -d flag in top specifies delay interval, not a filesystem path.
Question 37
A DevOps engineer needs to create a local Git repository. Which of the following commands should the engineer use?
Show answer and explanation
Correct answer: A. git init
git init creates a new local Git repository in the current directory, initializing the .git folder and configuration. This is the command needed to start a brand new repository. git clone copies an existing repository, git config modifies settings, and git add stages changes for commit.
Why the other options are wrong
- B. git clone copies an existing remote repository rather than creating a new local one.
- C. git config manages repository or global configuration settings, not repository creation.
- D. git add stages files for committing but does not create a repository.
Question 38
Which of the following utilities supports the automation of security compliance and vulnerability management?
Show answer and explanation
Correct answer: D. OpenSCAP
OpenSCAP (Security Content Automation Protocol) is a framework and toolkit specifically designed to automate security compliance checking and vulnerability management. It evaluates system configurations against security baselines and standards, providing comprehensive compliance and vulnerability assessment capabilities.
Why the other options are wrong
- A. SELinux is a mandatory access control system that enhances security but is not a dedicated compliance and vulnerability automation tool.
- B. Nmap is a network scanning tool for discovery and port scanning, not for compliance and vulnerability management automation.
- C. AIDE is a file integrity monitoring tool; it detects unauthorized file changes but does not automate comprehensive compliance and vulnerability management.
Question 39
Following the completion of monthly server patching, a Linux administrator receives reports that a critical application is not functioning. Which of the following commands should help the administrator determine which packages were installed?
Show answer and explanation
Correct answer: A. dnf history
dnf history displays a transaction history of all package installations, removals, and updates performed through DNF. This command allows the administrator to see exactly which packages were installed or modified during the patching window, making it the best tool to identify what changed during monthly patching.
Why the other options are wrong
- B. dnf list shows currently available and installed packages but doesn't show installation history or recent changes.
- C. dnf info provides detailed information about a specific package but requires knowing the package name in advance.
- D. dnf search finds packages matching a search term but doesn't show installation history or recent changes.
That was 39 of 155.
The full CompTIA Linux+ XK0-006 pack has all 155 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 77 free as one PDF by email. Get the Half Pack →