CompTIA CompTIA Certifications XK0-005 Questions & Answers

• Question 211:

  A new application container was built with an incorrect version number. Which of the following commands should be used to rename the image to match the correct version 2.1.2?

  A. docker tag comptia/app:2.1.1 comptia/app:2.1.2

  B. docker push comptia/app:2.1.1 comptia/app:2.1.2

  C. docker rmi comptia/app:2.1.1 comptia/app:2.1.2

  D. docker update comptia/app:2.1.1 comptia/app:2.1.2

  Correct Answer: A

  The best command to use to rename the image to match the correct version 2.1.2 is A. docker tag comptia/app:2.1.1 comptia/app:2.1.2. This command will create a new tag for the existing image with the new version number, without changing the image content or ID. The other commands are either incorrect or not suitable for this task. For example:

  B. docker push comptia/app:2.1.1 comptia/app:2.1.2 will try to push two images to a remote repository, but it does not rename the image locally. C. docker rmi comptia/app:2.1.1 comptia/app:2.1.2 will try to remove two images from the local system, but it does not rename the image. D. docker update comptia/app:2.1.1 comptia/app:2.1.2 will try to update the configuration of a running container, but it does not rename the image.

• Question 212:

  A systems administrator is troubleshooting connectivity issues and trying to find out why a Linux server is not able to reach other servers on the same subnet it is connected to. When listing link parameters, the following is presented:

  

  Based on the output above, which of following is the MOST probable cause of the issue?

  A. The address ac:00:11:22:33:cd is not a valid Ethernet address.

  B. The Ethernet broadcast address should be ac:00:11:22:33:ff instead.

  C. The network interface eth0 is using an old kernel module.

  D. The network interface cable is not connected to a switch.

  Correct Answer: D

  Explanation: The most probable cause of the connectivity issue is that the network interface cable is not connected to a switch. This can be inferred from the output of the ip link list dev eth0 command, which shows that the network interface eth0 has the NO- CARRIER flag set. This flag indicates that there is no physical link detected on the interface, meaning that the cable is either unplugged or faulty. The other options are not valid causes of the issue. The address ac:00:11:22:33:cd is a valid Ethernet address, as it follows the format of six hexadecimal octets separated by colons. The Ethernet broadcast address should be ff:ff:ff:ff:ff:ff, which is the default value for all interfaces. The network interface eth0 is not using an old kernel module, as it shows the UP flag, which indicates that the interface is enabled and ready to transmit data. References: CompTIA Linux+ (XK0-005) Certification Study Guide, Chapter 14: Managing Networking

• Question 213:

  A Linux administrator is scheduling a system job that runs a script to check available disk space every hour. The Linux administrator does not want users to be able to start the job. Given the following:

  

  The Linux administrator attempts to start the timer service but receives the following error message:

  

  Which of the following is MOST likely the reason the timer will not start?

  A. The checkdiskspace.timer unit should be enabled via systemct1.

  B. The timers.target should be reloaded to get the new configuration.

  C. The checkdiskspace.timer should be configured to allow manual starts.

  D. The checkdiskspace.timer should be started using the sudo command.

  Correct Answer: C

  Explanation: The most likely reason the timer will not start is that the checkdiskspace.timer should be configured to allow manual starts. By default, systemd timers do not allow manual activation via systemct1 start, unless they have RefuseManualStart=no in their [Unit] section. This option prevents users from accidentally starting timers that are meant to be controlled by other mechanisms, such as calendar events or dependencies. To enable manual starts for checkdiskspace.timer, the administrator should add RefuseManualStart=no to its [Unit] section and reload systemd. The other options are not correct reasons for the timer not starting. The checkdiskspace.timer unit does not need to be enabled via systemct1 enable, because enabling a timer only makes it start automatically at boot time or after a system reload, but does not affect manual activation. The timers.target does not need to be reloaded to get the new configuration, because reloading a target only affects units that have a dependency on it, but does not affect manual activation. The checkdiskspace.timer does not need to be started using the sudo command, because the administrator is already running systemct1 as root, as indicated by the # prompt. References: systemd.timer(5) - Linux manual page; systemct1(1) - Linux manual page

• Question 214:

  A cloud engineer wants to delete all unused networks that are not referenced by any container. Which of the following commands will achieve this goal?

  A. docker network erase

  B. docker network clear

  C. docker network prune

  D. docker network rm

  Correct Answer: C

  The docker command is used to manage Docker containers, images, networks, volumes, and other resources on a Linux system. Docker is a platform that allows users to run applications in isolated environments called containers. Docker also provides networking features that allow users to create and manage networks for containers. To delete all unused networks that are not referenced by any container, the cloud engineer can use the docker network prune command. This command will remove all networks that have no containers connected to them. The statement C is correct. The statements A, B, and D are incorrect because they do not delete all unused networks. The docker network erase and docker network clear commands do not exist. The docker network rm command deletes a specific network by name or ID, but not all unused networks. References: [How to Manage Docker Networks]

• Question 215:

  A Linux administrator needs to correct the permissions of a log file on the server. Which of the following commands should be used to set filename.log permissions to -rwxr--r--. ?

  A. chmod 755 filename.log

  B. chmod 640 filename.log

  C. chmod 740 filename.log

  D. chmod 744 filename.log

  Correct Answer: A

  Explanation: The command chmod 755 filename.log should be used to set filename.log permissions to -rwxr--r--. The chmod command is a tool for changing file permissions on Linux file systems. The permissions can be specified in octal notation, where each digit represents the permissions for the owner, group, and others respectively. The permissions are encoded as follows:

  0: no permission

  1: execute permission

  2: write permission

  4: read permission

  5: read and execute permissions (4 + 1)

  6: read and write permissions (4 + 2)

  7: read, write, and execute permissions (4 + 2 + 1) The command chmod 755 filename.log will set the permissions to -rwxr--r--, which means that the owner has read, write, and execute permissions (7), the group has read and execute permissions (5), and others have read and execute permissions (5). This is the correct command to use to accomplish the task. The other options are incorrect because they either set the wrong permissions (chmod 640, chmod 740, or chmod 744) or do not exist (chmod -G). References: CompTIA Linux+ (XK0-005) Certification Study Guide, Chapter 11: Managing Files and Directories, page 345.

• Question 216:

  Which of the following will prevent non-root SSH access to a Linux server?

  A. Creating the /etc/nologin file

  B. Creating the /etc/nologin.allow file containing only a single line root

  C. Creating the /etc/nologin/login.deny file containing a single line +all

  D. Ensuring that /etc/pam.d/sshd includes account sufficient pam_nologin.so

  Correct Answer: A

  This file prevents any non-root user from logging in to the system, regardless of the authentication method. The contents of the file are displayed to the user before the login is terminated. This can be useful for system maintenance or security reasons12. References: 1: Creating the /etc/nologin File - Oracle 2: How to Restrict Log In Capabilities of Users on Ubuntu

• Question 217:

  Joe, a user, is unable to log in to the Linux system. Given the following output:

  

  Which of the following commands would resolve the issue?

  A. usermod -s /bin/bash joe

  B. pam_tally2 -u joe -r

  C. passwd -u joe

  D. chage -E 90 joe

  Correct Answer: B

  The command pam_tally2 -u joe -r will resolve the issue of Joe being unable to log in to the Linux system. The pam_tally2 command is a tool for managing the login counter for the PAM (Pluggable Authentication Modules) system. PAM is a framework for managing authentication and authorization on Linux systems. PAM allows the administrator to define the rules and policies for accessing various system resources and services, such as login, sudo, ssh, or cron. PAM also supports different types of authentication methods, such as passwords, tokens, biometrics, or smart cards. PAM can be used to implement login restrictions, such as limiting the number of failed login attempts, locking the account after a certain number of failures, or enforcing a minimum or maximum time between login attempts. The pam_tally2 command can display, reset, or unlock the login counter for the users or hosts. The -u joe option specifies the user name that the command should apply to. The -r option resets the login counter for the user. The command pam_tally2 -u joe - r will reset the login counter for Joe, which will unlock his account and allow him to log in to the Linux system. This will resolve the issue of Joe being unable to log in to the Linux system. This is the correct command to use to resolve the issue. The other options are incorrect because they either do not unlock the account (usermod -s /bin/bash joe or passwd -u joe) or do not affect the login counter (chage -E 90 joe). References: CompTIA Linux+ (XK0-005) Certification Study Guide, Chapter 17: Implementing Basic Security, page 517.

• Question 218:

  A Linux administrator booted up the server and was presented with a non-GUI terminal. The administrator ran the command systemct1 isolate graphical.target and rebooted the system by running systemct1 reboot, which fixed the issue. However, the next day the administrator was presented again with a non-GUI terminal. Which of the following is the issue?

  A. The administrator did not reboot the server properly.

  B. The administrator did not set the default target to basic.target.

  C. The administrator did not set the default target to graphical.target.

  D. The administrator did not shut down the server properly.

  Correct Answer: C

  Explanation: The issue is that the administrator did not set the default target to graphical.target. A target is a unit of systemd that groups together other units by a common purpose or state. The graphical.target is a target that starts the graphical user interface (GUI) along with other services. The administrator used the command systemct1 isolate graphical.target to switch to this target temporarily, but this does not change the default target that is activated at boot time. To make this change permanent, the administrator should have used the command systemct1 set-default graphical.target, which creates a symbolic link from /etc/systemd/system/default.target to /usr/lib/systemd/system/graphical.target. The other options are not correct explanations for the issue. The administrator did reboot the server properly by using systemct1 reboot, which shuts down and restarts the system cleanly. The administrator did not need to set the default target to basic.target, which is a minimal target that only starts essential services. The administrator did not shut down the server improperly, which could have caused file system corruption or data loss, but not affect the default target. References: systemct1(1) - Linux manual page; How to Change Runlevels (targets) in SystemD

• Question 219:

  A systems administrator is working on a security report from the Linux servers. Which of the following commands can the administrator use to display all the firewall rules applied to the Linux servers? (Select two).

  A. ufw limit

  B. iptables --F

  C. systemct1 status firewalld

  D. firewall--cmd ----1ist--a11

  E. ufw status

  F. iptables --A

  Correct Answer: DE

  These commands can display all the firewall rules applied to the Linux servers, depending on which firewall service is being used.

  The firewall-cmd command is a utility for managing firewalld, which is a dynamic firewall service that supports zones and services. The --list-all option will show all the settings and rules for the default zone, or for a specific zone if specified.

  For example, firewall-cmd --list-all --zone=public will show the rules for the public zone1.

  The ufw command is a frontend for iptables, which is a low-level tool for manipulating netfilter, the Linux kernel's packet filtering framework. The status option will show the status of ufw and the active rules, or the numbered rules if verbose is

  specified. For example, ufw status verbose will show the numbered rules and other information2.

  The other options are incorrect because:

  A. ufw limit

  This command will limit the connection attempts to a service or port using iptables' recent module. It does not display any firewall rules2.

  B. iptables -F

  This command will flush (delete) all the rules in the selected chain, or all chains if none is given. It does not display any firewall rules3.

  C. systemctl status firewalld

  This command will show the status of the firewalld service, including whether it is active or not, but it does not show the firewall rules4.

  F. iptables -A

  This command will append one or more rules to the end of the selected chain. It does not display any firewall rules3.

• Question 220:

  After installing a new version of a package, a systems administrator notices a new version of the corresponding, service file was Installed In order to use the new version of the, service file, which of the following commands must be Issued FIRST?

  A. systemct1 status

  B. systemct1 stop

  C. systemct1 reinstall

  D. systemct1 daemon-reload

  Correct Answer: D

  Explanation: After installing a new version of a package that includes a new version of the corresponding service file, the systemct1 daemon-reload command must be issued first in order to use the new version of the service file. This

  command will reload the systemd manager configuration and read all unit files that have changed on disk. This will ensure that systemd recognizes the new service file and applies its settings correctly. The systemct1 status command will

  display information about a service unit, but it will not reload the configuration. The systemct1 stop command will stop a service unit, but it will not reload the configuration. The systemct1 reinstall command does not exist. References:

  CompTIA Linux+ (XK0-005) Certification Study Guide, Chapter 17:

  System Maintenance and Operation, page 518.