CompTIA Linux+ (XK0-006) Practice Questions with Explanations

Correct answer: D

OpenSCAP (Security Content Automation Protocol) is a framework and toolkit specifically designed to automate security compliance checking and vulnerability management. It evaluates system configurations against security baselines and standards, providing comprehensive compliance and vulnerability assessment capabilities.

Why the other options are wrong:

• A. SELinux is a mandatory access control system that enhances security but is not a dedicated compliance and vulnerability automation tool.
• B. Nmap is a network scanning tool for discovery and port scanning, not for compliance and vulnerability management automation.
• C. AIDE is a file integrity monitoring tool; it detects unauthorized file changes but does not automate comprehensive compliance and vulnerability management.

Correct answer: A

Log aggregation is the practice of collecting and consolidating system logs from multiple sources into a single centralized location for easier monitoring and analysis. Health checks monitor system status but don't consolidate logs. Webhooks are event-driven notifications. Threshold monitoring alerts when metrics exceed set limits.

Why the other options are wrong:

• B. Health checks verify system availability and status but don't consolidate logs to a single location.
• C. Webhooks are callbacks for event notifications, not log consolidation mechanisms.
• D. Threshold monitoring alerts when values exceed limits but is not about consolidating system events.

Correct answer: A

The `netplan try` command applies network configuration changes with an automatic rollback if the connection is lost or not confirmed within a timeout period, preventing outages. The `netplan apply` command applies changes permanently without rollback protection. The other options (rebind, ip) are not valid netplan subcommands.

Why the other options are wrong:

• B. The `netplan rebind` command does not exist as a valid netplan subcommand.
• C. The `netplan ip` command does not exist; `ip` is a separate tool for network configuration.
• D. The `netplan apply` command commits changes permanently without automatic rollback protection.

Correct answer: A

The command `cd /var/www/html/ && gzip -c /home/dev/web.bkp | tar xf -` changes to the target directory and then extracts the compressed backup file there. The `-c` flag for gzip decompresses to stdout, which is piped to `tar xf -` to extract from stdin, with `-x` extracting and `-f -` reading from stdin.

Why the other options are wrong:

• B. The syntax uses `$$` which is invalid (should be `;`), and cpio requires different input format than a .bkp file would typically provide.
• C. This command uses tar with `-c` (create) mode instead of extract mode, and specifies the wrong paths, effectively creating an archive rather than extracting.
• D. unzip is for ZIP archives, not .bkp files; the syntax is also incorrect for extraction to a directory.

Correct answer: D

The dd command with the specified parameters (if=/dev/sdc of=/tmp/image bs=8192) creates an exact, bit-for-bit block-level copy of the entire disk. The bs parameter sets the block size for efficient copying, making this the proper forensic imaging approach that preserves all data including unallocated space.

Why the other options are wrong:

• A. cp -rp copies files and directories but not at the block level; it cannot create a forensic image of an entire disk.
• B. cpio is an archive tool designed for file-level copying, not for creating block-level disk images.
• C. tar creates compressed archives of files and directories, not block-level forensic images of raw disk devices.

Correct answer: C

H3s@1dSh3t0|d is the most complex because it includes uppercase letters (H, S), lowercase letters (s, d, h, t), numbers (3, 1, 0), and special characters (@, |). A complex password requires multiple character types from different categories. This password has 13 characters and uses all four character type categories.

Why the other options are wrong:

• A. H3sa1dt01d contains only uppercase, lowercase, and numbers (missing special characters), making it less complex.
• B. he$@ID$heTold contains lowercase, uppercase, and special characters but only uses two numbers, with fewer total character types represented.
• D. HeSaidShetold uses only letters (uppercase and lowercase), lacking both numbers and special characters, making it the least complex option.

Correct answer: C

Password policies restrict multiple password changes on the same day to prevent users from rapidly cycling through old passwords to circumvent password history requirements. If users could change passwords multiple times daily, they could quickly rotate back through their history to reuse a previously compromised or simply preferred password, defeating the security purpose of password history enforcement. This is a fundamental security control in most enterprise environments.

Why the other options are wrong:

• A. Multiple password changes do not relate to the length or feasibility of brute-force attacks.
• B. Multiple changes on the same day would not increase password complexity; it relates to reuse prevention.
• D. This restriction is independent of multifactor authentication requirements or encryption algorithms.

Correct answer: C

The `chattr +a` command sets the append-only attribute on a file, preventing deletion or overwriting of existing content while allowing new data to be appended. The `setenforce` command controls SELinux enforcement mode. The `setfacl` command manages ACLs. The `chmod +t` command sets the sticky bit for directory protection.

Why the other options are wrong:

• A. The `setenforce` command controls SELinux enforcement modes, not file append restrictions.
• B. The `setfacl` command manages access control lists, not append-only attributes.
• D. The sticky bit (`+t`) prevents deletion in shared directories but doesn't restrict file overwriting.

Correct answer: C

LDAP (Lightweight Directory Access Protocol) is the standard protocol for accessing distributed directory services that maintain hierarchical information about users, groups, machines, and organizational units. It is widely used in enterprise environments for centralized identity and access management.

Why the other options are wrong:

• A. SMB is a file sharing protocol used for network file access, not directory services.
• B. TLS is a cryptographic protocol for secure communication, not a directory service protocol.
• D. KRB-5 (Kerberos) is an authentication protocol, not a directory service protocol for organizing hierarchical information.

Correct answer: B

An Ansible Inventory is the component that contains the list of hosts and host groups that Ansible will manage. It can be a static file (like /etc/ansible/hosts) or dynamically generated, and organizes target systems into groups for orchestration.

Why the other options are wrong:

• A. Facts are system information gathered from hosts during playbook execution, not a listing of hosts themselves.
• C. Playbooks are YAML files containing tasks and plays to execute on hosts, not the inventory of hosts.
• D. Collections are organized groupings of Ansible content like roles, modules, and plugins, not host listings.

Correct answer: D

To make an environment variable persistent across login sessions, it must be added to a shell configuration file like ~/.bashrc, ~/.bash_profile, or ~/.profile. Option D correctly uses echo with redirection (>>) to append the export statement to ~/.bashrc, ensuring the variable is set every time the user logs in. Option A has an incorrect file path (~/.ssh/profile doesn't exist) and uses improper syntax. Option B exports the variable only for the current session. Option C sets a variable without exporting it, making it unavailable to child processes.

Why the other options are wrong:

• A. Uses non-existent file path ~/.ssh/profile and malformed syntax with incorrect variable expansion.
• B. Only sets the variable for the current shell session; it will be lost when the session ends.
• C. Sets a variable without exporting it, so it won't be available to subprocesses and is not persistent.

Correct answer: C

The rm -r command removes a directory and all of its contents recursively. The -r (or -R) flag is essential for deleting non-empty directories and everything within them. This is the standard and correct approach for removing a directory tree. Option A (rmdir -p) only removes empty directories in a parent-child chain, not directories with contents. Option B (ln -d) is not a valid deletion command; ln creates symbolic links. Option D (cut -d) is a text processing utility for field extraction, not for file deletion.

Why the other options are wrong:

• A. rmdir only removes empty directories; it will fail on /home/user1/data if it contains files.
• B. ln -d is not a valid command for directory deletion; ln is for creating links.
• D. cut -d is a text processing tool for parsing fields in data, not for file system operations.

Correct answer: D

lsof (list open files) with grep filtering shows which processes have files or directories open within /data1. When a filesystem is busy, it's typically because one or more processes have open file handles or working directories there. This command directly identifies what's keeping the filesystem in use.

Why the other options are wrong:

• A. ps -f /data1 is invalid syntax; ps does not accept filesystem paths as arguments.
• B. du -sh /data1 shows disk usage but doesn't identify which processes are actively using the filesystem.
• C. top -d /data1 is invalid syntax; the -d flag in top specifies delay interval, not a filesystem path.

Correct answer: D

The modinfo command displays detailed information about a kernel module, including version, license, author, description, and dependencies. It queries the module metadata directly. Option A (modprobe) loads or unloads kernel modules but doesn't display version information. Option B (lsmod) lists currently loaded modules but provides minimal information and cannot target unloaded modules. Option C (depmod) analyzes kernel module dependencies but doesn't display module version details.

Why the other options are wrong:

• A. modprobe is used to load or remove kernel modules, not to query their version information.
• B. lsmod lists loaded modules but does not provide detailed version or metadata information.
• C. depmod generates module dependency information, not version details about specific modules.

Correct answer: A

The correct process is first generating an RSA key pair with `ssh-keygen -t rsa`, then copying the public key to the remote server with `ssh-copy-id -i ~/.ssh/id_rsa.pub user@server`. Option B uses wrong commands (ssh-keyscan and incorrect key path). Option C misuses ssh-agent. Option D uses ssh-add and scp incorrectly for this purpose.

Why the other options are wrong:

• B. The `ssh-keyscan` command is for host key verification, and the syntax and key path are incorrect.
• C. The `ssh-agent` command manages keys but isn't used with `-i` flag in this manner for initial setup.
• D. The `ssh-add` command loads keys into the agent, and `scp` shouldn't be used to copy the .ssh directory.

Correct answer: A

dnf history displays a transaction history of all package installations, removals, and updates performed through DNF. This command allows the administrator to see exactly which packages were installed or modified during the patching window, making it the best tool to identify what changed during monthly patching.

Why the other options are wrong:

• B. dnf list shows currently available and installed packages but doesn't show installation history or recent changes.
• C. dnf info provides detailed information about a specific package but requires knowing the package name in advance.
• D. dnf search finds packages matching a search term but doesn't show installation history or recent changes.

Correct answer: C

Linting generated code is a best practice when using AI to generate infrastructure-as- code. Linters check code for syntax errors, style violations, and potential bugs before deployment, ensuring quality and security. This validates and improves AI-generated code before it enters production.

Why the other options are wrong:

• A. Copy and paste of AI-generated code without review or modification is a poor practice that can introduce errors and security vulnerabilities.
• B. Generating monolithic code blocks is not a best practice; modular, smaller code units are preferable for maintainability.
• D. Merging CI/CD pipelines is not a specific best practice related to using AI for infrastructure-as-code generation.

Correct answer: A

The `getent passwd accounting` command (note: the question shows 'qetent' which appears to be a typo for 'getent') retrieves user information from the passwd database, displaying the user ID (UID), home directory, and assigned shell for the specified user in a single output line.

Why the other options are wrong:

• B. The `id` command displays UID, GID, and group memberships, but not the home directory or shell information.
• C. The /etc/shadow file contains password hashes and expiration information, not user ID, home directory, or shell assignments.
• D. The `who` command shows currently logged-in users, not detailed user account configuration like UID, home directory, or shell.

Correct answer: D

The qemu-img command is the standard tool for managing QEMU/KVM disk images, including converting between different formats (raw, qcow2, vmdk, vdi, etc.). It provides options like 'convert' to transform disk images from one format to another. Option A (qemu-kvm) is the hypervisor itself, not a management tool. Option B (qemu-ng) does not exist as a standard QEMU tool. Option C (qemu-io) is used for low-level disk I/O testing and debugging, not format conversion.

Why the other options are wrong:

• A. qemu-kvm is the hypervisor executable for running virtual machines, not for managing disk images.
• B. qemu-ng is not a standard QEMU utility for disk image management.
• C. qemu-io is a diagnostic tool for disk I/O operations, not for converting image formats.

Correct answer: B

Before adopting any new technology or tool-especially one handling proprietary source code-an organization must first verify that company policy permits and governs its use. This is a foundational step that addresses intellectual property, security, compliance, and liability concerns. Using AI tools without organizational approval could violate company policy, expose proprietary code, or create legal issues. The other options involve implementation details that should only follow after policy approval is confirmed.

Why the other options are wrong:

• A. Researching AI chatbots is premature without first establishing whether the company permits AI use.
• C. Installing infrastructure is an implementation step that should follow policy verification.
• D. Tool selection is a later step that assumes policy approval has already been obtained.

Correct answer: A

The `docker run -it app-01-image` command creates a new container from the specified image and connects to it interactively. The `-i` flag keeps STDIN open even if not attached, and `-t` allocates a pseudo-terminal, allowing the administrator to interact with the running container immediately.

Why the other options are wrong:

• B. docker start is used to start an existing stopped container, not create a new one from an image.
• C. docker build is used to build images from a Dockerfile, not create or connect to containers.
• D. docker exec runs commands in an already-running container; it cannot be used to initially create and connect to a container.

Correct answer: A

Playbooks in Linux systems (specifically Ansible playbooks) are used to define a set of tasks and configurations needed to deploy applications or manage systems. They provide automation and orchestration, allowing administrators to specify desired states and execute complex deployment workflows.

Why the other options are wrong:

• B. Version control implementation is managed through version control systems (git, etc.), not playbooks.
• C. Security information for containers is typically defined in Dockerfiles or container security policies, not playbooks.
• D. Storage volume information for pods is defined in Kubernetes manifests and persistent volume configurations, not playbooks.

Correct answer: B

The renice command lowers the priority of a running process, allowing it to consume less CPU time relative to other processes. This directly addresses the problem by reducing CPU allocation to the maintenance task, thereby allowing other applications to run more smoothly without stopping the maintenance work.

Why the other options are wrong:

• A. pidstat is a monitoring tool that displays CPU statistics; it cannot increase CPU time allocation.
• C. nohup allows a process to run after logout but does not affect CPU priority or allocation.
• D. The bg utility moves a job to the background, but the maintenance task is already consuming excessive CPU; this does not solve the performance issue.

Correct answer: D

systemd-analyze blame displays startup times for each service in descending order, allowing the administrator to see exactly how long NetworkManager took to start. resolvectl manages DNS settings, journalctl reviews logs without timing data, and systemctl daemon-reload reloads unit files without showing timing analysis.

Why the other options are wrong:

• A. resolvectl is used to query and configure DNS resolution settings, not to measure service startup times.
• B. journalctl displays service logs but does not provide startup timing analysis.
• C. systemctl daemon-reload reloads configuration files but does not display service startup duration information.

Correct answer: B

A centralized log aggregation solution is the best approach for managing event records across multiple Linux servers. It provides reliable, secure, and scalable log management by collecting logs from all servers in one place, enabling easier monitoring, analysis, and compliance. This addresses the complexity mentioned in the question by providing a unified view of OS and application events across the infrastructure.

Why the other options are wrong:

• A. On-demand log retrieval is reactive rather than proactive and doesn't address the systematic management of event records.
• C. Backing up logs to remote storage helps with retention but doesn't solve the complexity of managing and analyzing logs across multiple servers.
• D. Log rotation only manages individual server logs; it doesn't provide centralized visibility or analysis across the infrastructure.

Correct answer: B

Python 3 is extensible through modules and libraries, allowing developers to add functionality through imports and third-party packages. Python is open source, not closed. It is not fully backwards compatible with Python 2. It is not binary compatible with Java; while it can interface with Java, they are separate runtime environments.

Why the other options are wrong:

• A. Python is open source software available for modification and distribution.
• C. Python 3 has significant breaking changes from Python 2, making it not fully backwards compatible.
• D. Python and Java are separate languages with different runtimes; they are not binary compatible with each other.

Correct answer: A

The dmidecode command reads and displays the system's DMI (Desktop Management Interface) information, providing a comprehensive hardware inventory including BIOS, motherboard, CPU, memory, and other hardware components in a human-readable format.

Why the other options are wrong:

• B. lsmod displays loaded kernel modules, not hardware inventory.
• C. dmesg shows kernel log messages and boot information, not a complete hardware inventory.
• D. lscpu displays only CPU information, not a full hardware inventory of the entire system.

Correct answer: D

The command systemctl list-units --type=services displays all service units on a Linux system, including their status (active/inactive, enabled/disabled). This is the standard systemctl command for viewing comprehensive service status information across the entire system.

Why the other options are wrong:

• A. The is-active flag only checks if a specific service is running, not all services, and does not accept --services as a valid option.
• B. list-sockets is used for socket units, not services, and --type-services is not valid syntax.
• C. The is-enabled flag only checks if a service is configured to start at boot for specific services, not for listing all services.

Correct answer: B

The shred command securely erases file data by overwriting it multiple times before deletion, making it difficult or impossible to recover. When used on a disk device, it performs secure erasure suitable for sensitive data destruction in forensic scenarios.

Why the other options are wrong:

• A. rm -rf does not securely erase data; deleted files can still be recovered from disk.
• C. parted is a partition management tool; the rm subcommand removes partitions but does not securely erase disk contents.
• D. dd with /dev/null creates zeros on the disk but does not provide the secure overwriting that shred does.

Correct answer: C

ufw allow 53/tcp from 10.0.0.0/24 is the correct syntax to open DNS TCP port 53 for incoming connections from the specified network. The allow action, port/protocol specification, and from clause are all properly formatted according to UFW syntax. Option A uses incorrect 'dns/tcp' instead of port number, option B uses 'enable' incorrectly, and option D uses 'disable' which closes rather than opens the port.

Why the other options are wrong:

• A. ufw does not recognize 'dns/tcp' as valid syntax; the port number 53 must be specified explicitly.
• B. ufw enable activates the firewall globally but does not create specific rules; the syntax is also incorrect.
• D. ufw disable closes the firewall entirely rather than opening a specific port for a network range.

Correct answer: C

The PATH environment variable controls which directories the shell searches for executable programs. By appending /home/user/scripts to PATH using export PATH=$PATH:/home/user/scripts, the user can run scripts from that directory by name alone without specifying the full path. This is the standard method for making custom scripts directly executable.

Why the other options are wrong:

• A. SHELL variable specifies the default shell, not the directory search path for executables.
• B. TERM variable specifies terminal type for display, not executable search paths.
• D. The alias command syntax is incorrect and aliases are not the proper mechanism for directory-based executable access.

Correct answer: B

/etc/resolv.conf is the standard Linux configuration file for setting DNS servers and resolver behavior. This file contains nameserver entries that specify which DNS servers the system should query. The administrator would add or modify nameserver lines in this file to configure the new DNS server's IP address.

Why the other options are wrong:

• A. /etc/whois.conf is used for configuring WHOIS client settings, not DNS servers.
• C. /etc/nsswitch.conf configures name service switching for various databases like passwd and group, not DNS server addresses.
• D. /etc/dnsmasq.conf is for configuring dnsmasq (a DNS forwarder), not for setting a system's DNS server address.

Correct answer: B

The docker ps command lists all running containers, making it the appropriate tool to validate whether containers are currently active. It displays container ID, image, status, ports, and other metadata. Option A (docker start) starts a stopped container rather than checking status. Option C (docker run) creates and runs a new container, not checking existing ones. Option D (docker images) lists available images, not running container status.

Why the other options are wrong:

• A. docker start is used to start a stopped container, not to check whether containers are running.
• C. docker run creates and executes a new container instance, not for checking existing container status.
• D. docker images displays locally available container images, not information about running containers.

Correct answer: B

The `docker image pull Debian` command downloads the latest Debian image from the default Docker repository (Docker Hub) to the local system. The `pull` subcommand is the correct operation for fetching images from remote repositories.

Why the other options are wrong:

• A. docker image init is not a valid Docker command for downloading images.
• C. docker image import is used to import images from tar archives or containers, not to pull from repositories.
• D. docker image save exports existing local images to tar files; it does not download images from repositories.