CompTIA Linux+ XK0-006 (V8) Practice Question

The correct answer is /proc/4815/exe. This is a symbolic link that points to the actual pathname of the executed command. By resolving this link, an administrator can find the full path to the executable file associated with the process, even if the file has been deleted or replaced on disk after being loaded into memory.

• /proc/4815/cmdline is incorrect because it contains the full command line used to invoke the process, including arguments, with null characters separating each item. While it often starts with the command name, it may not be an absolute path and can be manipulated by the process itself.
• /proc/4815/status is incorrect. This file provides human-readable information about the process's state, memory usage, UID, GID, and other metadata, but it does not contain the full path to the executable.
• /proc/4815/cwd is also incorrect. This is a symbolic link that points to the current working directory of the process, not to the executable file itself.