CompTIA Certification
62 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The CompTIA Linux+ (XK0-005) certification validates professional expertise in CompTIA technologies. This study guide covers all 62 practice questions from our XK0-005 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
You need to configure a system to automatically mount a network filesystem at boot time. Which file should you modify to ensure persistent mounting across reboots?
/etc/fstab is the static filesystem information file used to configure automatic mounting at boot time. /etc/mtab and /proc/mounts are dynamic and reflect current mounts, while /etc/mount.conf does not exist.
A user reports that their process is consuming excessive CPU resources. You want to see real-time process statistics including CPU and memory usage. Which command should you use?
The top and htop commands provide real-time monitoring of processes with dynamic updates showing CPU and memory usage. The ps command shows static snapshots, while vmstat and iostat focus on system-level statistics rather than individual processes.
You are implementing a backup strategy and need to create incremental backups that only store changes since the last backup. Which backup method should you implement?
Incremental backups store only the changes since the last backup of any kind, providing efficient storage. Differential backups store changes since the last full backup, while mirrors and daily fulls are less efficient for this use case.
When analyzing system performance, you notice high I/O wait time. Which tool provides the most detailed information about disk I/O operations?
iostat provides detailed input/output statistics for devices and partitions. free shows memory usage, uptime shows system uptime and load average, and lsof lists open files but not I/O statistics.
You need to configure SELinux to allow a specific application to read files in a non-standard directory. Which approach is most appropriate?
Creating a custom SELinux policy module allows fine-grained control while maintaining security. Disabling SELinux removes all protections, changing ownership addresses DAC not MAC, and limits.conf controls resource limits, not file access.
A service fails to start during boot but starts successfully when run manually. What is the most likely cause related to service dependencies?
Services with unmet or unstated dependencies may fail during boot when other services haven't started yet. Manual execution works because prerequisite services are already running. File permissions, corruption, and credentials would cause failures in both scenarios.
You want to find all files modified in the last 24 hours across the entire filesystem. Which command is most efficient and appropriate?
The find command with -mtime 0 locates files modified within the last 24 hours. The -mmin -1440 option also works but -mtime 0 is the standard approach. The -newer option requires a reference file, and ls piping is inefficient for large filesystems.
When configuring a firewall rule using iptables, you need to drop all incoming traffic on port 22 from a specific subnet while allowing established connections. Which rule structure is correct?
The correct approach allows established connections first with stateful filtering, then explicitly drops the specified subnet. Option A accepts all port 22 traffic, C deletes rules, and D rejects all port 22 traffic without condition.
You are troubleshooting DNS resolution issues on a client system. Which file contains the list of nameservers the system should query?
/etc/resolv.conf specifies the nameservers for DNS queries. /etc/hosts is for static hostname mappings, /etc/hostname stores the system hostname, and /etc/nsswitch.conf configures name service lookup order.
A process is consuming all available memory and is unresponsive. You want to send a signal that allows the process to perform cleanup operations before terminating. Which signal should you use?
SIGTERM (15) allows graceful shutdown with cleanup. SIGKILL (9) forces termination without cleanup, SIGSTOP (19) pauses the process, and SIGHUP (1) is for terminal hangup or configuration reload.
When implementing disk quotas for users, you need to ensure quota limits are enforced at mount time. Which kernel parameter or mount option must be enabled?
Filesystem quotas require both kernel/filesystem support and mount-time options in /etc/fstab with usrquota or grpquota. quotaon enables quotas after configuration but isn't a prerequisite. SELinux doesn't affect quota functionality, and no such /proc parameter exists.
You need to monitor system resource usage over extended periods for capacity planning. Which tool generates reports of historical system performance data?
sar collects historical system activity data and generates reports over time, making it ideal for capacity planning. dstat and glances provide real-time monitoring, and nmon is an interactive performance monitor without the historical reporting focus.
A user's home directory is full, but du shows less space than df reports as used. What is the most likely explanation?
Deleted files that are still open by running processes consume space on disk but aren't counted by du. Hard links don't duplicate space, fragmentation doesn't affect usage reports, and SELinux doesn't hide files from du.
You want to create a compressed archive of a directory while preserving symbolic links as links rather than following them. Which tar option should you use?
The -P (or --absolute-names) option preserves symbolic links as links. The -h option follows symlinks and includes content, --follow-symlinks also expands symlinks, and --no-recursion prevents directory traversal.
When configuring sudo, you want to allow a specific user to run only backup commands without requiring a password. Where should this configuration be placed?
sudo rules are configured in /etc/sudoers or in files within /etc/sudoers.d/ directory. .bashrc is for shell configuration, limits.conf controls resource limits, and .sudo_config is not a valid sudo configuration file.
You are analyzing a core dump file from a crashed application for debugging purposes. Which tool allows you to inspect and debug the core dump interactively?
gdb can load and analyze core dumps interactively, providing stack traces and variable inspection. objdump, strings, and hexdump provide limited information without full debugging capabilities.
A cron job is not executing as expected. You've verified the cron syntax is correct and the script has proper permissions. What should you check next to diagnose the issue?
Comprehensive cron troubleshooting requires checking access controls, daemon status, and log files. All three steps are necessary to fully diagnose cron issues.
You need to configure a system to use a custom DNS server that should take precedence over DHCP-assigned servers. How should this be configured on a systemd system with networkd?
On systemd systems, custom DNS is configured in /etc/systemd/resolved.conf with DNS= taking precedence. Direct /etc/resolv.conf editing is overwritten by systemd, nmcli is for NetworkManager, and ignoring DHCP DNS isn't a proper solution.
When setting up log rotation with logrotate, you want to ensure that application-specific logs are rotated daily and old logs are kept for 30 days. Which configuration options should be used?
The 'daily' option rotates logs daily, 'rotate 30' keeps 30 rotated copies, and 'compress' saves space. The 'size' option is for size-based rotation (not time-based), maxage is for removing old files by age, and hourly isn't standard daily rotation.
You've deployed an application that requires access to hardware devices. The application runs as an unprivileged user but needs to access /dev/ttyUSB0. What is the most secure way to grant this access?
Adding the user to the device's group or using udev rules provides secure, granular access control. Running as root, world-readable devices, and setuid binaries all introduce unnecessary security risks.
A system is experiencing intermittent network connectivity issues. Which command provides real-time statistics about network interface errors and dropped packets?
netstat -i displays interface statistics including error counts and dropped packets. ip link and ifconfig show interface status but limited error details, while ethtool -S provides driver-specific statistics that may vary.
When implementing a Linux container strategy, you want to ensure that containers can be started and managed by non-root users securely. Which technology and configuration should be employed?
Rootless containers with proper user namespace configuration provide secure non-root container management. Adding users to the docker/podman group grants privileges equivalent to root, sudo without passwords is insecure, and suid binaries are a legacy approach.
You need to verify that a service is properly configured to start automatically at boot in a systemd system. Which command provides this information?
systemctl is-enabled checks if a service is enabled for automatic startup. status shows current state, list-unit-files shows all services, and show with Enabled property may not display the same format on all systems.
You are implementing file-level encryption for sensitive data on a Linux system. Which approach provides transparent encryption at the filesystem level?
eCryptfs and fscrypt provide transparent filesystem-level encryption that's automatic and performant. Manual openssl encryption isn't transparent, LUKS is volume-level not file-level, and application-level encryption is not filesystem-level transparency.
A user accidentally deleted important files from their home directory. These files were not backed up separately. If the filesystem has available space and deletions just occurred, which approach offers the best recovery chance?
Tools like extundelete and testdisk search for recoverable deleted file data on the filesystem. fsck is for filesystem consistency, not recovery. Backups and professional recovery are alternatives, but the question implies no backup exists.
You're configuring a system to use both IPv4 and IPv6 addresses on a single interface. Which approach ensures both protocols function simultaneously without conflicts?
Dual-stack IPv4/IPv6 is configured in network configuration files with separate address specifications. Option B is one method but not the only one, aliasing separates protocols unnecessarily, and CPU management doesn't apply to network protocols.
When analyzing system security, you want to identify all listening network ports and the processes associated with them. Which command provides comprehensive output for this task?
netstat -tlnp or ss -tlnp shows listening TCP/UDP ports with associated process information. nmap performs external scanning, lsof requires careful filtering, and iptables shows firewall rules, not listening ports.
Which command is used to display the current working directory in Linux?
The pwd command prints the working directory path to standard output. The cd command changes directories, ls lists files, and dir is not a standard Linux command.
What is the purpose of the umask command?
The umask command sets a mask that determines which permissions are NOT given to newly created files and directories. It affects the default permissions assigned during file creation.
Which of the following best describes the purpose of the /etc/sudoers file?
The /etc/sudoers file specifies which users and groups have permission to run commands with sudo (elevated privileges) and under what conditions. It is managed with the visudo command to prevent syntax errors.
What does the sticky bit do when applied to a directory?
The sticky bit on a directory ensures that only the file owner, directory owner, or root can delete or rename files within it, preventing accidental or malicious deletion by other users with write access. This is commonly used on directories like /tmp.
Which command would you use to search for files modified within the last 7 days?
The find command with -mtime -7 searches for files modified less than 7 days ago. The negative sign means 'less than', while a positive value would mean 'more than' or 'exactly' that many days.
What is the primary purpose of the chroot command?
The chroot command changes the root directory for a process and its children, creating an isolated filesystem environment. This is useful for security, testing, and running applications in confined spaces.
Which file contains the mapping of IP addresses to hostnames on a local system?
The /etc/hosts file contains static mappings of IP addresses to hostnames that the system checks before querying DNS. The /etc/hostname file contains only the system's hostname, while /etc/resolv.conf specifies DNS servers.
When configuring a network interface with a static IP address, which file would you typically edit in a systemd-based distribution?
Modern systemd-based distributions like Ubuntu use netplan for network configuration, with YAML files stored in /etc/netplan/. The first option is Debian-based non-systemd systems, and the third is for older Red Hat-based systems.
What is the purpose of the /proc filesystem?
The /proc filesystem is a virtual filesystem that provides dynamic information about running processes, kernel statistics, and system configuration via special files. It exists only in memory and is not stored on disk.
Which command would you use to monitor real-time system resource usage, including CPU and memory?
The top command provides a real-time, interactive view of system resource usage including CPU, memory, and processes. vmstat shows memory statistics, iotop shows disk I/O, and netstat shows network connections.
What does the -R option do when used with the chmod command?
The -R (recursive) option with chmod applies the specified permission changes to a directory and all its contents, including subdirectories and files. This is useful for batch permission modifications.
Which systemd unit type is responsible for managing system mount points?
Mount units (*.mount files) manage filesystem mount points in systemd, replacing traditional /etc/fstab entries. Service units manage daemons, socket units handle socket activation, and timer units schedule tasks.
What is the purpose of the journalctl command?
The journalctl command is used to query and view logs collected by the systemd journal service. It can filter logs by time, priority, unit, and other criteria, replacing traditional text-based log file viewing.
How would you view the contents of a compressed tar archive without extracting it?
The tar -tzf command lists (t) the contents of a compressed gzip (z) tar file (f) without extracting. The -x flag extracts, -c creates, and -v shows verbose output.
Which of the following best describes the purpose of the /etc/fstab file?
The /etc/fstab (filesystem table) file defines static filesystem configuration, specifying which filesystems to mount at boot time, including mount points, filesystem types, and options. Modern systemd systems can also use /etc/fstab.
What is the significance of the SUID (Set User ID) bit when applied to an executable file?
The SUID bit causes an executable to run with the permissions of its owner, not the user executing it. This is commonly used for programs like passwd that need elevated privileges but shouldn't grant full root access.
Which command is used to view the current DNS resolver configuration on a Linux system?
On traditional systems, /etc/resolv.conf contains DNS configuration, while modern systemd systems use systemd-resolve for DNS resolution. Both commands can be used depending on the system's configuration.
What does the lsof command primarily display?
The lsof command (list open files) displays all files and network connections currently open by running processes. This is useful for troubleshooting, finding which processes have locked files, and security analysis.
When setting up a cron job, what does the asterisk (*) in the minute field represent?
In cron syntax, an asterisk (*) in any field means 'every' value for that field. An asterisk in the minute field means the job runs every minute of every hour it is otherwise scheduled.
Which of the following is the correct way to set an environment variable in a login shell?
The export command sets an environment variable that is inherited by child processes. The env command runs another command with modified environment variables but does not persist them in the current shell.
What is the primary role of the Linux kernel's inode structure?
An inode is a data structure that stores metadata about a file or directory, including permissions, ownership, modification times, and pointers to data blocks. The inode does not store the actual file contents.
Which command would you use to display the amount of disk space used by a specific directory and its contents?
The du -sh command shows the disk usage (du) of a directory (-s for summary, -h for human-readable). The df command shows filesystem usage, ls shows file listings, and stat shows file metadata.
What is the purpose of the /etc/shadow file?
The /etc/shadow file stores encrypted password hashes and password policy information (expiration, minimum age, etc.) and is readable only by root, providing enhanced security compared to /etc/passwd.
Which of the following best describes the role of the /etc/default directory?
The /etc/default directory contains configuration files that set default parameters, environment variables, and options for various system services and utilities (e.g., /etc/default/grub for GRUB bootloader settings).
When examining process priorities with the nice and renice commands, what does a lower nice value indicate?
In Linux, lower nice values (ranging from -20 to 19) indicate higher priority for CPU scheduling. A process with nice value -10 will receive more CPU time than a process with nice value +10.
A system administrator needs to configure a network interface to use a static IP address of 192.168.1.100/24 with gateway 192.168.1.1. Which file should be edited on a Red Hat-based system?
On Red Hat-based systems, network interface configurations are stored in /etc/sysconfig/network-scripts/. The file naming convention is ifcfg-<interface-name>, where the administrator can define IP, gateway, and other network settings.
Which command is used to display the current runlevel of a Linux system?
The 'runlevel' command displays both the previous and current runlevel of the system. In systemd systems, this can also be checked with 'systemctl get-default', but 'runlevel' remains a standard utility.
A Linux administrator wants to ensure that a script runs every day at 2:30 AM. The script should not run if the system was powered down at that time. Which scheduling method is most appropriate?
Standard cron is appropriate for recurring daily tasks at specific times when the system is expected to be running. While anacron handles missed jobs on systems that power down, cron is the standard choice for reliable daily scheduling on always-on systems.
An administrator is troubleshooting a service that fails to start. The systemd service file contains 'Type=forking'. What does this configuration indicate?
Type=forking tells systemd that the service will spawn a child process and exit the parent. Systemd monitors the remaining child process. This is common for traditional daemon-style services that daemonize themselves.
Which of the following best describes the purpose of the umask value?
The umask is a bitmask that defines which permission bits are turned OFF by default when new files or directories are created. For example, a umask of 0022 removes write permissions for group and others.
A user reports that they cannot read a file with permissions -rw-r-----. They are the file owner and belong to the correct group. What is the most likely reason?
Even with read permissions on the file, a user must have execute (x) permission on the parent directory to access the file at all. Directory execute permission allows traversal, which is prerequisite for accessing any files within.
When configuring sudo, an administrator wants to allow a specific user to run only the /usr/bin/systemctl command without requiring a password. Which sudoers entry is correct?
The correct sudoers syntax is 'user HOST=(RUNAS_USER) NOPASSWD: COMMAND'. This entry allows 'user' to run /usr/bin/systemctl on all hosts as any user without a password prompt.
An administrator observes that disk I/O performance is degrading. They check iostat and see high await times and low throughput. Which factor is most likely causing this issue?
High await times (average time I/O requests spend in queue) and low throughput indicate the storage device itself is the bottleneck, whether due to hardware limitations, high queue depth, or physical drive issues.
Which of the following correctly describes the relationship between inodes and filenames in a Linux filesystem?
Inodes contain file metadata (permissions, timestamps, data blocks). Directory entries map human-readable filenames to inode numbers. Multiple directory entries (hard links) can reference the same inode, but each has a different filename.
A system administrator wants to create a systemd service that should only start after the network has been fully configured. Which target should be added to the After= directive?
The network-online.target ensures the system waits until network connectivity is fully established and services are reachable, whereas network.target only indicates network interfaces are up. For services requiring actual connectivity, network-online.target is appropriate.
You've reviewed all 62 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free