CompTIA Linux+ Practice Test (XK0-006)

The useradd command copies everything found in the skeleton directory into the new user's home when the home is created with the -m option. By default the skeleton directory is /etc/skel, as defined by the SKEL variable in /etc/default/useradd. Therefore, placing the prepared .bashrc and .vimrc inside /etc/skel guarantees that each new account receives its own copies of the files with no further steps.

Adding lines to /etc/profile only makes shells source a shared file at login; it does not place files in the user's home. A non-existent COPY_FILES variable is never read by useradd, so it has no effect. Finally, /etc/login.defs does not contain a SKEL setting, so pointing that file at another directory would not influence account creation.

The correct answer is that 10 represents the delay in minutes. The /etc/anacrontab file has four fields: period delay job-identifier command. The period is the frequency in days. The delay is the number of minutes anacron will wait after it starts before executing the job (if the job's period has passed). This delay prevents anacron jobs from consuming system resources immediately at boot. The job-identifier is a unique name for logging, and the command is the script to be executed. The value is not a job priority or a specific time of day, which are common misconceptions from other scheduling tools like nice and cron.

The exec-form CMD array (CMD ["/usr/sbin/nginx", "-g", "daemon off;"]) launches the given executable directly, so the process becomes PID 1 and receives signals correctly. Because it is a CMD, any arguments supplied after the image name in docker run completely override the default command, letting operators substitute a different program without using --entrypoint.

The shell-form CMD variant runs through /bin/sh -c, so Nginx would not be PID 1 and signal handling could break. An ENTRYPOINT in exec form makes the command harder to replace (it can only be changed with --entrypoint, not by ordinary arguments). RUN executes at build time, not when the container starts, so it cannot define the runtime command.

The correct action is to obtain a TLS certificate from a publicly trusted Certificate Authority (CA). Web browsers and operating systems maintain a list of trusted root CAs. When a browser connects to a server, it verifies that the server's TLS certificate is signed by a CA in its trust store, establishing a valid chain of trust. This prevents security warnings and assures users of the site's authenticity.

Generating a self-signed certificate, either manually with openssl or by using a default 'snake oil' certificate, is not appropriate for a public e-commerce site. Because these certificates are not signed by a trusted CA, browsers will display a prominent security warning, which would deter customers. SSH keys are used for securing remote administrative access (e.g., shell sessions) and are not used for securing web traffic with TLS/HTTPS; the two systems serve different purposes and are not interchangeable.

The audit2allow -M option builds a loadable binary policy package that ends with the .pp extension. SELinux policy packages are installed into the module store with the semodule utility. Using semodule -i mon_agent.pp loads the package, rebuilds the system policy, and stores the module so it is automatically loaded each time the system boots.

The other choices are incorrect:

• semanage -i is not a valid option for importing policy packages; semanage manages SELinux settings such as ports, booleans, and file contexts, not modules.
• audit2allow -i is not a valid command syntax and cannot install a module.
• setenforce 0 merely switches the system to permissive mode and does nothing to incorporate the new module.

Therefore, semodule -i mon_agent.pp is the correct action.

High values in the rx_queue__drops* counters mean that the network interface's descriptor ring is overflowing before the driver can service it. Enlarging the RX (and usually TX) ring with a command such as ethtool -G eno1 rx 4096 tx 4096 gives the adapter more buffer space, preventing packets from being discarded during bursts. Lowering the MTU, disabling GRO, or shrinking the transmit queue do not address ring-buffer exhaustion and can actually decrease overall performance.

The correct choice is a commercial certificate from a trusted Certificate Authority (CA). For a public-facing e-commerce site handling financial data, establishing trust is paramount. Commercial CAs offer different levels of validation, including Organization Validated (OV) and Extended Validation (EV) certificates. These require a thorough vetting of the organization, providing a higher level of assurance to visitors compared to domain-only validation. Commercial certificates are universally trusted by all browsers, preventing security warnings that would deter customers. They also often come with financial warranties, which adds another layer of security assurance for the business.

A self-signed certificate is unsuitable because it is not signed by a trusted CA, which causes browsers to display prominent security warnings, eroding customer trust. A no-cost certificate, while valid and trusted by browsers for encryption, typically only offers Domain Validation (DV). This doesn't provide the organizational vetting that is crucial for a high-trust e-commerce platform. A certificate from an internal corporate CA is only intended for internal use and would not be trusted by the public or their browsers, resulting in security errors for external visitors.

The correct command is ip address add 10.0.0.5/8 dev eth0. The ip address add command is part of the modern iproute2 suite and is used to add an additional IP address to a network interface. This does not interfere with any existing IP addresses on the interface.

• ip address set is incorrect because set is not a valid action for the ip address command. The primary actions are add, del, and show.
• ip route add is incorrect because it is used to modify the system's routing table, which dictates how packets are forwarded to other networks, not to assign an IP address to a local interface.
• ifconfig eth0:1... is incorrect because ifconfig is a legacy command from the net-tools package. While it was used to create IP aliases, the modern and tested standard is the ip command from the iproute2 package.

The correct command is lvchange -an data_vg/app_data. The lvchange command is used to alter the attributes of a logical volume. The -a flag sets the activation state, and n (for 'no') deactivates the volume, making it unavailable to the system without deleting it. The lvremove command would permanently delete the logical volume and its data. The vgchange command operates on the entire volume group, not a specific logical volume. The lvresize command is used to change the size of a logical volume, not its activation state.

In an audit watch rule, the -p flag specifies which file operations should trigger logging:

• w - write access (data changes)
• a - attribute changes (permission, ownership, timestamp, etc.)
• r - read access
• x - execute access

To record both data changes and metadata changes while excluding simple reads, the rule needs w and a but must not include r. The correct syntax therefore combines them as -p wa. Adding -k identity_change tags the resulting records, and -w /etc/shadow sets the watch on the required file.

The other options are wrong because they either log read access (include r), omit attribute changes (omit a), or use a system-call style rule that still lacks the a permission. Hence only the rule with -p wa meets all stated conditions.

The correct answer identifies the primary data governance risk. Pasting sensitive information like proprietary code and credentials into a public AI service exposes that data to the service provider. Many public AI services state in their terms of use that they may use customer data to train their models, and they may also employ human reviewers who can see the data. This creates a significant risk of that confidential data being absorbed into the model and potentially exposed to other users, or being otherwise compromised, leading to a serious data breach. The other options describe valid but less significant or different types of risks. Generating inefficient code is a code quality risk, not a data governance risk. Violating 'shift-left testing' is a process issue. A developer's skill degradation is a personnel risk, not a data governance risk.

The correct answer is to thoroughly review the AI-generated output for accuracy and context before integrating it. AI tools can generate plausible-sounding but incorrect or incomplete documentation. Best practices for responsible AI usage mandate that a human expert must verify the output, especially for technical and business-logic-specific details, to ensure it is accurate and relevant. Simply copying the output without review is irresponsible and can lead to propagating errors. While AI can be used for refactoring or generating tests, those are different tasks and do not fulfill the primary requirement of documenting the existing scripts. Generating documentation and then immediately archiving it without integrating it into the codebase or a version control system provides no value to future developers.

The correct answer is the column labeled PPID. In the output of the ps -ef command, the PPID column explicitly lists the Parent Process Identification Number for each process. This number is the process ID (PID) of the process that created the current process. The PID column shows the process's own unique ID. The UID column shows the User ID of the process owner. C (or %CPU) represents the percentage of CPU utilization.

Sanitizing or redacting secret material before it is transmitted ensures the LLM never receives the data, eliminating the possibility that the model could store, leak, or later regenerate the credentials. Transport encryption (TLS) only protects data in transit, not after it reaches the provider. Embedding "do not disclose" comments relies on the model's voluntary compliance and does not stop the data from entering its context window. Restricting the plug-in to a non-production branch still exposes any secrets that appear in those files.

SSSD can perform access control itself. When the access provider for a domain is set to ad, adding an ad_access_filter limits logins to entries that match the supplied LDAP filter. Inserting the two lines shown in the correct option restricts access to users whose memberOf attribute contains the LinuxAdmins group DN.

Enabling enumeration (option 2) only causes SSSD to list all users and groups; it does not control logins. Adding simple_allow_groups without switching the provider to simple (option 3) has no effect, because the simple access lists are ignored when another provider is active. Disabling credential caching (option 4) merely forces online authentication and does not restrict which identities can log in.

The correct command is iperf3 -c 10.0.1.10 -R. By default, an iperf3 test sends data from the client to the server, which measures the upload speed of the client. The -R (or --reverse) flag reverses the direction of the test, causing the server (ServerA) to send data to the client (ServerB). This correctly measures the download speed on the client machine. The command iperf3 -c 10.0.1.10 would measure the upload speed from ServerB to ServerA. The command iperf3 -s -c 10.0.1.10 is invalid because the -s (server) and -c (client) flags are mutually exclusive. The --get-server-output flag is used to retrieve the server's final report at the client, but it does not alter the direction of the data transfer.

A strong copyleft license such as the GNU GPL satisfies both conditions. The GPL is expressly designed to propagate its terms to all derivative works (including those created through static or dynamic linking), and it requires that any party who distributes binaries also provide the complete corresponding source code. Weak copyleft licenses like the LGPL only compel publication of changes to the library itself and allow proprietary programs to link without relicensing. Permissive licenses (MIT, BSD, Apache) impose minimal conditions and let downstream redistributors close their code. A dual-licensing model that offers proprietary terms would allow recipients to circumvent the copyleft altogether, defeating the stated goals.

The correct setting is PermitRootLogin prohibit-password. This directive in the sshd_config file specifically disables password and keyboard-interactive authentication for the root user while still allowing other authentication methods like public key authentication.

• PermitRootLogin no would be incorrect as it completely disables root login via SSH, which violates the requirement to allow key-based login for emergencies.
• PermitRootLogin yes is incorrect because it would allow root login using any method, including passwords, which is against the stated security policy.
• PermitRootLogin forced-commands-only is also incorrect in this scenario. While it does use key-based authentication, it restricts the root user to only executing specific commands defined in the authorized_keys file and does not grant an interactive shell, which would likely be needed for 'emergency maintenance'.

The first snippet chains two separate POSIX‐compliant tests with the && operator:

• [ -f "$f" ] verifies that the pathname refers to a regular file.
• $(stat -c%s "$f") -gt 104857600 obtains the size in bytes with stat and performs a numeric greater-than comparison using -gt.

If both tests succeed, gzip runs; otherwise the next file is examined. All commands (for, test/[ ], stat, gzip) are available on a typical Linux system and require no Bash-specific extensions.

The second snippet checks for directories, not regular files, and therefore skips every log file.
The third snippet attempts to use the redirection operator > inside test, which redirects output instead of performing a numeric comparison.
The fourth snippet relies on the arithmetic compound command (( )), which is a Bash extension and not guaranteed in /bin/sh.

The correct answer is tcpdump. The tcpdump command is a protocol analyzer used to capture and display the contents of packets on a network interface. This allows an administrator to perform deep packet inspection to analyze traffic, such as identifying malformed packets. nmap is a network scanner used for host discovery and port scanning, but it does not capture the full content of packets for analysis. netstat is used to display network connections, routing tables, and interface statistics, but it does not capture packet data. OpenSCAP is a tool for auditing system compliance against security policies and is not used for real-time packet analysis.