CompTIA Linux+ (XK0-006) — All Questions

Which directory in the Filesystem Hierarchy Standard is intended to hold variable data such as logs, spool files, and caches?

• a./etc
• b./var✓
• c./opt
• d./usr

/var stores variable data that changes during normal operation, including /var/log, /var/spool, and /var/cache. /etc holds system configuration, /usr holds read-only user programs and libraries, and /opt holds optional add-on software packages.

On a Debian/Ubuntu system, which command updates the local package index without installing or upgrading any packages?

• a.apt upgrade
• b.dpkg --configure -a
• c.apt update✓
• d.apt full-upgrade

'apt update' refreshes the local package index from the configured repositories so the system knows about the latest available versions. 'apt upgrade' and 'apt full-upgrade' actually install newer packages, and 'dpkg --configure -a' finishes configuring partially installed packages.

Which systemctl command shows whether a service is set to start automatically at boot?

• a.systemctl is-enabled sshd✓
• b.systemctl status sshd --now
• c.systemctl is-active sshd
• d.systemctl mask sshd

'systemctl is-enabled' reports whether a unit is enabled to start at boot (enabled, disabled, static, masked, etc.). 'is-active' reports current runtime state rather than boot behavior, and 'mask' prevents a unit from being started at all.

Which command displays the block devices and their partition/LVM layout in a tree format, including mount points?

• a.df -h
• b.fdisk -l
• c.blkid
• d.lsblk✓

'lsblk' lists block devices in a tree showing disks, partitions, LVM volumes, sizes, and mount points. 'df -h' reports filesystem usage on mounted filesystems, 'blkid' shows UUIDs and types, and 'fdisk -l' shows partition tables but not a clean mount-point tree.

In an /etc/fstab entry, which field value causes a filesystem to be checked by fsck first (before other filesystems) at boot?

• a.The dump field set to 1
• b.The pass (fsck order) field set to 1✓
• c.The mount options field set to defaults
• d.The pass field set to 0

The sixth field in fstab is the fsck pass order: 1 is reserved for the root filesystem and is checked first, 2 for other filesystems, and 0 disables the check. The fifth (dump) field controls the legacy dump utility, not fsck ordering.

Which journalctl command shows kernel messages from the current boot only?

• a.journalctl --disk-usage
• b.journalctl -f
• c.journalctl -k -b✓
• d.journalctl --vacuum-time=1d

'journalctl -k' limits output to kernel messages (like dmesg) and '-b' limits it to the current boot, so '-k -b' shows this boot's kernel log. '-f' follows new entries, and '--vacuum-time' deletes old journal data rather than displaying it.

A process is consuming excessive CPU. Which command lets you interactively view and sort running processes by CPU usage in real time?

• a.top✓
• b.free
• c.uptime
• d.vmstat

'top' provides a live, interactive view of processes and can sort by CPU or memory usage. 'free' shows memory, 'uptime' shows load averages, and 'vmstat' prints periodic system statistics but is not an interactive process browser.

Which command shows listening TCP sockets along with the process holding each socket?

• a.ping -c 4 localhost
• b.ip addr show
• c.dig example.com
• d.ss -tlnp✓

'ss -tlnp' lists TCP (-t) listening (-l) sockets numerically (-n) with the owning process (-p). 'ip addr' shows interface addresses, 'ping' tests reachability, and 'dig' performs DNS lookups.

Users cannot resolve hostnames but can reach servers by IP. Which command directly tests DNS resolution?

• a.ip route
• b.dig www.example.com✓
• c.ss -s
• d.traceroute 8.8.8.8

'dig' queries DNS servers and returns resolution details, making it the direct tool for diagnosing name-resolution problems. 'ip route' inspects the routing table, 'ss -s' shows socket statistics, and 'traceroute' maps the network path by IP.

A filesystem reports 'No space left on device' but 'df -h' shows free space. Which command helps identify inode exhaustion?

• a.du -sh /
• b.lsof +L1
• c.df -i✓
• d.mount -a

'df -i' reports inode usage; a filesystem can run out of inodes (often from many tiny files) while still showing free blocks. 'du' measures space consumed, 'lsof +L1' finds deleted-but-open files, and 'mount -a' remounts fstab entries.

Which command sends the default TERM signal to a process by PID, allowing it to shut down gracefully?

• a.kill 1234✓
• b.kill -9 1234
• c.kill -STOP 1234
• d.kill -HUP 1234

'kill 1234' with no signal sends SIGTERM (15), which asks the process to terminate gracefully so it can clean up. 'kill -9' sends SIGKILL which cannot be caught, '-STOP' pauses the process, and '-HUP' typically triggers a reload.

Which command creates a new user with a home directory and sets bash as the login shell in one step?

• a.usermod -aG bash alice
• b.useradd -m -s /bin/bash alice✓
• c.passwd -m alice
• d.groupadd -s /bin/bash alice

'useradd -m -s /bin/bash alice' creates the account, makes the home directory (-m), and sets the login shell (-s). 'usermod' modifies an existing user, 'passwd' manages passwords, and 'groupadd' creates groups.

Which command adds an existing user to a supplementary group without removing them from their other groups?

• a.usermod -g developers bob
• b.gpasswd -d bob developers
• c.useradd -G developers bob
• d.usermod -aG developers bob✓

'usermod -aG developers bob' appends (-a) the user to the supplementary group (-G) while preserving existing memberships. Omitting -a with -G replaces all supplementary groups, '-g' changes the primary group, and 'gpasswd -d' removes a member.

What is the recommended way to grant a user limited sudo privileges safely?

• a.Add a file in /etc/sudoers.d/ edited with visudo✓
• b.Manually edit /etc/passwd to add root
• c.chmod 4777 /bin/su
• d.Add the user to /etc/shadow

Placing a drop-in file in /etc/sudoers.d/ and editing it with visudo validates syntax before saving, preventing lockouts and keeping rules modular. Editing /etc/passwd or /etc/shadow does not grant sudo, and setting 4777 on /bin/su is a serious security hole.

Which command forces a user to change their password at next login?

• a.passwd -l alice
• b.usermod -L alice
• c.chage -d 0 alice✓
• d.chage -E 0 alice

'chage -d 0 alice' sets the last-password-change date to the epoch, forcing a change at next login. 'passwd -l' and 'usermod -L' lock the account, and 'chage -E 0' sets an account expiration date rather than forcing a password reset.

Which special permission bit, when set on a directory, ensures that only a file's owner (or root) can delete or rename files within it?

• a.SUID
• b.Sticky bit✓
• c.SGID
• d.Read-only bit

The sticky bit (as on /tmp, shown as 't') restricts deletion so only the file owner, directory owner, or root can remove or rename entries. SUID and SGID affect execution identity and group inheritance, not deletion restrictions.

Which command reports the current SELinux enforcement mode?

• a.aa-status
• b.ufw status
• c.getenforce✓
• d.sestatus --relabel

'getenforce' prints the current SELinux mode: Enforcing, Permissive, or Disabled. 'aa-status' is for AppArmor, 'ufw status' checks a firewall, and 'sestatus --relabel' is not a valid option (sestatus alone gives detailed status).

In firewalld, which command permanently allows inbound HTTPS traffic in the default zone?

• a.firewall-cmd --permanent --add-service=https✓
• b.iptables -A INPUT -j DROP
• c.firewall-cmd --panic-on
• d.nft flush ruleset

'firewall-cmd --permanent --add-service=https' adds the https service to the zone's persistent configuration (apply with --reload). '--panic-on' blocks all traffic, 'iptables -A INPUT -j DROP' would drop packets, and 'nft flush ruleset' erases nftables rules.

Which sshd_config setting most effectively hardens SSH by preventing direct root logins?

• a.PasswordAuthentication yes
• b.X11Forwarding yes
• c.PermitEmptyPasswords yes
• d.PermitRootLogin no✓

Setting 'PermitRootLogin no' forces administrators to log in as a normal user and escalate with sudo, reducing brute-force and audit risk. Enabling password auth, empty passwords, or X11 forwarding weakens rather than strengthens the configuration.

In a bash script, which variable holds the exit status of the most recently executed command?

• a.$#
• b.$?✓
• c.$!
• d.$0

'$?' contains the exit status of the last command, where 0 means success and non-zero indicates an error. '$#' is the argument count, '$!' is the PID of the last background job, and '$0' is the script name.

Which cron schedule expression runs a job every day at 2:30 AM?

• a.30 2 * * *✓
• b.* 2 30 * *
• c.2 30 * * *
• d.30 2 * * 0

Cron fields are minute, hour, day-of-month, month, day-of-week, so '30 2 * * *' means minute 30 of hour 2 every day. '30 2 * * 0' would restrict it to Sundays, and the other orderings misplace the minute and hour fields.

In Ansible, which characteristic describes a well-written task that can run repeatedly without changing the result after the first successful run?

• a.Imperative
• b.Ephemeral
• c.Idempotent✓
• d.Stateful

Idempotency means applying the same task multiple times yields the same end state, so Ansible only makes changes when the system differs from the desired state. This is a core principle of infrastructure-as-code that prevents unintended repeated modifications.