CompTIA Linux+ Practice Test (XK0-006)

The correct command is virsh list --all. The virsh command is the main command-line interface for managing guest virtual machines controlled by the libvirt daemon. The list subcommand, by default, shows only running VMs. To include inactive (shut down) VMs, the --all option is required.

• virt-manager is a graphical user interface, not a command-line tool, and is unsuitable for a headless server.
• libvirtd is the daemon (service) that manages the virtualization platform; it is not a user-facing command-line tool for managing individual VMs.
• qemu-img is a command-line tool used for creating, converting, and modifying virtual machine disk images, not for listing or managing the state of VMs.

The correct command is sdiff -o app.conf app.conf.old app.conf.new. The sdiff command is used to compare two files side-by-side. The -o or --output option is specifically used to create a third file by interactively merging the two source files. When sdiff is run with this option, it prompts the user to choose which version of a differing line to keep. The command diff -u app.conf.old app.conf.new > app.conf creates a unified diff patch and redirects it to a file, but it is not an interactive merging process. The command sdiff app.conf.old app.conf.new | merge app.conf is incorrect as merge is not a standard command for this purpose and sdiff does not output to a pipe in a format suitable for another program to merge interactively. The command cp app.conf.old app.conf && sdiff --in-place app.conf app.conf.new is incorrect because sdiff does not have an --in-place option.

Refactoring the loop into a single awk one-liner yields the largest speed-up. awk is a compiled C program that reads the file once and performs pattern and field processing internally, avoiding the per-line overhead of Bash's read builtin and loop control. Switching to mapfile still requires per-line Bash processing and can exhaust memory on a 10 GB file. Changing CPU priority (nice) or disabling atime updates affects scheduling or disk metadata writes but does not eliminate the algorithmic bottleneck in the shell loop.

The correct command for this scenario is lsblk. The lsblk command is designed to list block devices in a tree-like format, which clearly shows the hierarchical relationship between disks, the partitions on those disks, and any logical volumes or RAID arrays built upon them. blkid is used to display attributes of block devices, such as their UUIDs and filesystem types, but it does not show the hierarchical structure. fdisk -l and parted -l are used to display partition tables but do not present the information in the intuitive, nested tree structure that lsblk provides, making it harder to visualize complex storage setups like those involving LVM.

Bash saves the in-memory history list to the file named by the HISTFILE variable when the shell exits. If HISTFILE is unset or set to a null value (for example, export HISTFILE="" or export HISTFILE=/dev/null), the write operation is skipped, so nothing is stored on disk, while the history list remains available during the session.

HISTSIZE limits how many commands are kept in memory; setting it has no effect on whether the file is written. HISTCONTROL only filters what gets saved, and HISTFILESIZE limits how many lines are retained in the file once it is written. None of those variables stop Bash from opening or updating the history file, so they do not satisfy the requirement.

The correct answer is that the ChrootDirectory path and all of its parent components must be owned by the root user and not be writable by any other user or group. This is a strict security requirement of the OpenSSH daemon to prevent the chrooted user from breaking out of the jail. If /home/user is designated as the chroot directory, both /home and /home/user must be owned by root. Since a user typically needs write access to their own home directory, the standard practice is to create a subdirectory inside the home directory (e.g., /home/user/upload) owned by the user, while the home directory itself remains owned by root. The internal-sftp subsystem does not require a separate sftp-server binary or a user shell like /bin/bash to be present within the jail. Firewall rules would typically prevent the initial connection, not cause a disconnect after authentication.

The command "tcpdump -i eth0 -nn tcp port 443 -w capture.pcap" meets every stated need: "-i eth0" selects the correct interface, "-nn" turns off both DNS hostname and service-name resolution, the filter expression "tcp port 443" limits the capture to HTTPS traffic in either direction, and "-w capture.pcap" writes the raw packets to the specified file.

A command that uses only "-n" still resolves service names, violating the requirement. The choice that specifies "udp port 443" captures the wrong protocol, and the command that employs "-r" reads from an existing file instead of writing live traffic, so it would not record new packets.

Git supports a pre-commit hook that runs automatically before each commit is recorded. By wiring this hook to tools such as pylint-which checks PEP 8 style and detects likely coding mistakes-and a formatter like black, the commit is rejected until the problems are fixed. This forces developers (including those using AI-generated code) to verify and correct output before the code leaves their workstation, fulfilling the exam objective of code linting and the AI guideline of verify output. Enabling Git LFS only changes how large files are stored; it does not analyze code. Rebasing/squashing tidies history but does not lint. GPG signing confirms authorship but performs no style or logic checks.

The FSF states that a program is free software only when users possess all four essential freedoms. Freedom 3 is the right "to distribute copies of your modified versions to others," so the community can benefit from improvements. A license that blocks distribution of modified code denies this freedom and therefore renders the software non-free.

• Freedom 0 is unaffected because the program can still be run for any purpose.
• Freedom 1 remains intact if the source can be studied and altered privately.
• Freedom 2 is satisfied because unmodified copies may be redistributed.
• Freedom 3, however, is revoked by the license's prohibition on sharing modified versions, so the software fails to meet the FSF definition of free software.

The remount option tells the kernel to change the mount options of an already-mounted file system in place. Adding ro sets the mount to read-only. Therefore, mount -o remount,ro / immediately flips the root file system to read-only while it remains mounted at /.

The other choices are incorrect:

• mount -o bind,ro / / attempts a bind mount; it would create a second mount of the same directory and is not how you change an existing mount's permissions.
• mount -o remount,nosuid / changes only the nosuid flag; the file system would still be read-write.
• mount -o remount,rw / explicitly keeps the file system read-write, the opposite of what is required.

The wa value in top (94 %) shows the CPUs are mostly waiting for I/O to complete, not running useful work. At the same moment, iostat reports the primary block device at 99 % %util, which the iostat manual states indicates device saturation for a serial device. Together these numbers point to the storage layer as the bottleneck that is delaying transactions and causing slow application responses. Moving the database and log files to storage with lower latency (for example, an SSD or dedicated NVMe device) reduces I/O wait time and should restore normal responsiveness.

Raising vm.swappiness alters paging behavior, but the host is not swapping (si/so are 0). Bonding NICs or shrinking the MTU address network throughput and fragmentation, yet none of the captured metrics suggest a network problem-CPU time is spent waiting on disk, not on sockets. Therefore, replacing or accelerating the storage subsystem is the action most likely to relieve the slowdown.

The ping command with the options -M do (set DF flag, do not allow fragmentation) and -s (payload length) is the standard way to probe Path-MTU from a Linux host. Starting with a 1472-byte payload (1500-byte MTU minus 20-byte IP and 8-byte ICMP headers) and decreasing the size until you receive replies tells you the exact maximum size that can pass the VPN tunnel. The other choices either modify the local interface MTU (which masks, not measures, the problem), display driver statistics, or list TCP listeners-none of which determines the path MTU between two endpoints.

The modern, POSIX-compliant form of command substitution is $( … ). It may be freely nested and does not require the awkward backslash-escaping that backticks need. Rewriting the command so that both the outer substitution and the inner date command use $( … ) resolves the parsing error and greatly improves readability:

BACKUP_DIR=$(tar -tzf backup.tar.gz | grep "$(date +%F)" | head -1)

Using backticks on the outside still leaves the legacy syntax in place, and mixing quoting with backticks provides no advantage. Keeping backticks inside the $( … ) form (or vice-versa) re-introduces the same nesting problem. Adding an extra pipeline with tr -d '\n' does not fix the underlying quoting issue and alters the data unexpectedly. Therefore, the variant that converts all substitutions to $( … ) and keeps the inner date expression inside double quotes is the only answer that meets best-practice guidance and works in any modern POSIX shell.

Destination NAT rules must be placed in a nat chain that is hooked at prerouting so the kernel can translate the destination address before routing. The correct syntax begins with nft add rule, specifies the ip family, the nat table, the prerouting chain, then matches packets arriving on eth0 with TCP destination port 443 and applies dnat to the internal host and port.

The other choices fail for different reasons:

• A rule in postrouting executes after routing decisions and is suited for SNAT or masquerade, not DNAT.
• Using snat changes the source address, not the destination, so it would not forward traffic to the backend server.
• A rule in the filter table with redirect would only forward traffic to a local port on the firewall and never reach 192.168.1.20.

Therefore, the first command is the only one that duplicates the original iptables DNAT behavior.

The correct command is sudo apt --fix-broken install. This option for the apt command is specifically designed to find and fix broken package dependencies on the system. It works by identifying missing dependencies and installing them, or by removing packages that are causing irreparable dependency conflicts.

• sudo apt-get autoremove is incorrect because it is used to remove packages that were automatically installed to satisfy dependencies for other packages and are now no longer needed. It does not fix broken installations.
• sudo apt-get update is also incorrect. This command only synchronizes the local package index files with the remote repositories; it does not install, upgrade, or fix any packages.
• sudo dpkg --configure -a is a plausible but incorrect choice in this primary step. This command configures all unpacked but unconfigured packages. While it can resolve some issues, apt --fix-broken install is the higher-level and more direct command for resolving dependency issues.