XK0-006 CompTIA Linux+ V8 Exam Questions and Answers

Log monitoring is a common troubleshooting task in Linux system administration, and Linux+ V8 covers command-line tools for real-time log analysis. The requirement in this scenario is twofold: view log entries as they occur and simultaneously save them to another file.

The command tail -f /var/log/apache2/error.log | tee logfile.txt fulfills both requirements. The tail -f command follows the log file in real time, displaying new entries as they are written. The pipe (|) sends this output to the tee command, which writes the data to logfile.txt while also displaying it on standard output.

The other options are insufficient. Option A redirects output to a file but prevents real-time viewing. Option C appends output but still suppresses terminal display. Option B is syntactically invalid and does not use a proper command for writing output.

Linux+ V8 documentation specifically references tee as a useful utility for duplicating command output streams. This makes option D the correct and most effective solution.

In Git-based workflows, especially those used in DevOps environments, it is common for administrators to have uncommitted local changes while needing to retrieve updates from a remote repository. Linux+ V8 emphasizes understanding how to safely manage local modifications during synchronization operations.

The command git stash is specifically designed for this scenario. It temporarily saves (or “stashes”) local changes in a stack-like structure and reverts the working directory to a clean state that matches the current HEAD. This allows the administrator to perform operations such as git pull without conflicts. Later, the stashed changes can be reapplied using git stash apply or git stash pop.

The other options are incorrect. git pull retrieves and merges remote changes but will fail or cause conflicts if local modifications exist. git merge combines branches and does not save uncommitted changes. git fetch downloads remote references but does not address local working directory changes.

Linux+ V8 documentation highlights git stash as a safe and reversible way to protect local work during repository updates. Therefore, the correct answer is A.

The use of AI-assisted tools for Infrastructure as Code (IaC) is increasingly common in modern DevOps practices, which are covered in the Automation and Orchestration domain of CompTIA Linux+ V8. While AI can accelerate code generation, Linux+ emphasizes that generated code must still follow best practices for quality, security, and maintainability.

Option C, linting generated code, is the correct answer. Linting involves analyzing code for syntax errors, style violations, logical issues, and potential security risks before deployment. When AI tools generate IaC artifacts such as Terraform files, Ansible playbooks, or shell scripts, linting ensures that the output adheres to organizational standards and does not introduce misconfigurations or vulnerabilities.

Linux+ V8 documentation stresses that automation does not eliminate the need for validation. Administrators remain responsible for verifying correctness and compliance. Linting tools such as ansible-lint, terraform fmt, and shell linters help detect issues early in the pipeline and prevent faulty infrastructure deployments.

The other options are poor practices. Copying and pasting code increases the risk of errors and inconsistency. Generating monolithic code contradicts modular IaC principles. Merging CI/CD pipelines is unrelated to validating AI-generated infrastructure code.

Therefore, the correct answer is C. Linting generated code.

Filesystem unmount failures are common troubleshooting scenarios covered in Linux+ V8. When the error “target is busy” appears, it means one or more processes are actively using files or directories within the mount point.

The correct diagnostic command is lsof | grep /data1. The lsof (list open files) utility displays all open files and the processes using them. Filtering the output with grep /data1 identifies exactly which processes are holding file descriptors on the filesystem, preventing it from being unmounted.

The other options are incorrect. ps -f displays process information but does not show open file usage. du -sh calculates disk usage and does not identify active processes. top monitors system performance but cannot pinpoint filesystem locks.

Linux+ V8 documentation emphasizes using lsof or fuser to identify resource locks before unmounting filesystems. Therefore, the correct answer is D.

The correct answer is D. qemu-img because it is the standard utility used to create, convert, and manage disk image files used by virtualization platforms such as KVM (Kernel-based Virtual Machine). One of its primary functions is converting disk images between different formats, such as qcow2, raw, vmdk, and vdi.

For example, an administrator can convert a disk image using a command like:

qemu-img convert -f qcow2 -O raw disk.qcow2 disk.raw

This capability is essential when migrating virtual machines between different hypervisors or when optimizing storage formats.

Option A (qemu-kvm) is incorrect because it is used to run virtual machines using KVM acceleration, not for managing or converting disk images.

Option B (qemu-nq) is incorrect because it is not a valid or commonly used QEMU command.

Option C (qemu-io) is incorrect because it is primarily used for debugging and testing disk I/O operations, not for format conversion.

From a Linux+ system management perspective, virtualization is a key topic, and tools like qemu-img are essential for managing virtual disk storage. Administrators frequently use it to resize images, check integrity, and convert formats when working in cloud, containerized, or virtualized environments. Understanding this command ensures efficient handling of virtual machine storage and supports interoperability across virtualization platforms.

According to the output of getfacl app, user1 has only " rw " (read and write) permissions, but lacks " x " (execute). Without execute permission, user1 cannot run the file. To allow user1 to execute app, you must update the ACL to add execute permission (e.g., setfacl -m u:user1:rwx app). Modifying " others " permissions (option B) is not secure or necessary, adding user1 to the wheel group (option C) is unrelated, and moving the file (option D) does not resolve permission issues.

Kernel module management is an important part of Linux system administration and is covered in the Linux+ V8 objectives. When an administrator needs to determine metadata about a kernel module—such as its version, author, description, license, filename, and dependencies—the correct tool is modinfo.

The command modinfo bluetooth displays detailed information about the specified kernel module, including the module version if it is defined. This makes it the correct and intended command for retrieving version details of kernel modules, whether or not the module is currently loaded.

The other options are incorrect. modprobe bluetooth is used to load or unload kernel modules and does not display version information. lsmod lists loaded modules but does not show version details and does not accept module names as arguments in that manner. depmod is used to generate module dependency information and does not provide module metadata to the administrator.

Linux+ V8 documentation specifically references modinfo as the utility for inspecting kernel module properties. This command is essential for troubleshooting driver issues, verifying compatibility, and auditing kernel components.

Therefore, the correct answer is D. modinfo bluetooth.

This issue is best analyzed using a layered troubleshooting approach, as recommended in the Troubleshooting domain of CompTIA Linux+ V8. The reported symptom is intermittent or random disconnections from an NFS share, which commonly indicates a network reliability issue rather than a configuration or filesystem problem.

The most critical evidence comes from the output of ip -s link show. The network interface enp1s0 is reporting significant numbers of errors and dropped packets on both the receive (RX) and transmit (TX) paths. High packet loss at the network interface level directly affects protocols like NFS, which rely on stable, continuous TCP/IP communication. When packets are dropped or corrupted, NFS clients may experience timeouts, retransmissions, and apparent disconnections.

Although the df -h output shows that the NFS filesystem is 95% full, this alone does not typically cause random disconnections. A nearly full filesystem may lead to write failures or performance degradation, but it does not explain intermittent connectivity loss. Linux+ V8 documentation notes that filesystem capacity issues usually present as I/O errors, not transport-layer disconnects.

Options A and B can also be ruled out. If the mount point or IP address were incorrect, the NFS share would fail consistently rather than intermittently. The fact that the share is mounted and accessible confirms that the mount configuration and IP addressing are correct.

Linux+ V8 emphasizes that NFS performance and reliability are highly sensitive to network quality. Packet errors, drops, faulty NICs, cabling issues, duplex mismatches, or driver problems commonly result in unstable NFS behavior.

Therefore, the best explanation for the reported random disconnections is D. The interface is reporting a high number of errors and dropped packets.

This scenario represents a classic CPU-bound performance issue, which is covered under the Troubleshooting domain of CompTIA Linux+ V8. The most important indicator is the load average compared to the number of available CPU cores.

The system has 4 CPU cores, as shown by nproc, but the load averages are consistently above 5, with a peak of 7.75. Load average reflects the number of processes either actively running on the CPU or waiting for CPU time. When the load average exceeds the number of CPU cores for extended periods, it indicates CPU contention. Processes must wait longer to be scheduled, resulting in delayed task completion.

The memory statistics confirm that memory is not the bottleneck. free -h shows over 3.5 GiB of available memory, and swap usage is minimal. Additionally, vmstat shows no significant swap-in or swap-out activity and low I/O wait, ruling out memory pressure and disk bottlenecks.

Increasing swap space would not help because the system is not memory constrained. Adding more disks would not address CPU scheduling delays. Increasing free memory is unnecessary because sufficient memory is already available.

Linux+ V8 documentation emphasizes correlating load average with CPU core count to diagnose CPU saturation. The most effective way to speed up job execution in this case is to increase CPU resources, such as adding more vCPUs, moving the workload to a more powerful system, or distributing the workload across multiple systems.

Therefore, the correct answer is B. Increase the amount of CPU resources available to the system.

Environment variables are widely used in Linux systems to configure application behavior, and Linux+ V8 emphasizes the distinction between temporary and persistent variables. A variable is persistent only if it is defined in a shell initialization file.

The correct approach is echo " export VAR=value " > > ~/.bashrc. This command appends the variable definition to the user’s .bashrc file, ensuring the variable is set automatically every time the user starts a new shell session. This makes the variable persistent for that specific user.

Options B and C only define variables in the current shell session and are lost when the session ends. Option A incorrectly targets the SSH configuration directory and is not appropriate for defining shell environment variables.

Linux+ V8 documentation highlights .bashrc, .bash_profile, and /etc/profile as correct locations for persistent environment variables. Therefore, the correct answer is D.

Understanding Linux filesystems and their purposes is a fundamental system management skill outlined in the Linux+ V8 objectives. Among the listed options, /proc is the filesystem that contains non-persistent, volatile data.

The /proc filesystem is a virtual filesystem that exists entirely in memory and is dynamically generated by the Linux kernel. It does not store data on disk and does not persist across system reboots. Instead, /proc provides real-time information about running processes, kernel parameters, system memory, CPU statistics, and hardware state. Files within /proc represent kernel data structures and change constantly as the system operates.

The other filesystems contain persistent data stored on disk. /boot stores bootloader files and kernel images, which are critical for system startup. /usr contains user applications, libraries, and documentation, all of which are persistent. /var holds variable data such as logs, spool files, and caches, which may change frequently but are still stored persistently on disk.

Linux+ V8 documentation emphasizes that /proc is used primarily for system monitoring and tuning. Administrators often interact with /proc to inspect process details or modify kernel parameters using tools like sysctl. Because its contents are generated at runtime and cleared on reboot, /proc is classified as non-persistent or volatile.

Therefore, the correct answer is C. /proc.

This scenario is a classic performance troubleshooting case covered under the Troubleshooting domain of the CompTIA Linux+ V8 objectives. The key indicators to analyze are the load average values and the CPU utilization statistics.

The uptime command shows load averages of 8.71, 8.24, and 7.71 over the 1-, 5-, and 15-minute intervals. Load average represents the average number of processes that are either running on the CPU or waiting to run. On a system with 4 CPU cores, a healthy load average would typically be close to or below 4. Load averages consistently near or above 8 indicate that there are significantly more runnable processes than available CPU resources, causing processes to wait and resulting in poor system responsiveness.

The CPU output further confirms this condition. The %idle value is 0, meaning the CPU has no idle time available. The majority of CPU time is spent in user space (65.88%) and system/kernel space (20.54%), indicating heavy computational and kernel activity. While %iowait is present at 5.65%, it is not high enough to suggest that disk I/O is the primary bottleneck.

Option C, high CPU load, best explains the symptoms. High CPU load causes commands to execute slowly because processes are competing for limited CPU time. This directly matches the observed behavior of the system being unresponsive.

The other options are incorrect. High uptime simply indicates how long the system has been running and does not cause performance issues by itself. High latency is a general term and not a specific diagnosis shown by the metrics provided. High I/O wait times would require a significantly higher %iowait value.

According to Linux+ V8 documentation, correlating load averages with CPU core count and utilization is essential for accurate performance diagnosis. Therefore, the correct answer is C. High CPU load.

Python scripting is part of Linux automation, and Linux+ V8 includes knowledge of Python development standards. PEP 8 stands for Python Enhancement Proposal 8 and defines the official style guide for Python code.

PEP 8 provides conventions for code layout, indentation, naming, line length, whitespace usage, and commenting. Its purpose is to improve code readability and maintainability, especially in collaborative environments. Linux+ V8 emphasizes that standardized coding practices are critical in automation and DevOps workflows.

The other options are incorrect. Python virtual environments are managed using tools such as venv. Package installation is handled by pip. Octal values are represented using specific syntax and are unrelated to PEP 8.

Therefore, the correct answer is A.

Pattern matching using regular expressions is a key troubleshooting and text-processing skill covered in CompTIA Linux+ V8. The grep command, combined with regular expressions, allows administrators to search for complex string patterns within files.

The requirement specifies:

The string must contain at least five characters

Character 2 must be i

Character 3 must not be b

Character 5 must be i

To meet these conditions, the correct regular expression structure is:

→ any character (position 1)

i → literal i (position 2)

[^b] → any character except b (position 3)

→ any character (position 4)

i → literal i (position 5)

This results in the expression:

i[^b].i

Option D, grep .i[^b].i myFile, correctly implements this logic. It ensures positional matching and excludes unwanted characters using a negated character class ([^b] ), which is explicitly covered in Linux+ V8 regular expression objectives.

The other options contain invalid or malformed regular expressions and do not meet the positional or exclusion requirements. Linux+ V8 emphasizes understanding anchors, character classes, and position-based matching when troubleshooting log files or configuration data.

Therefore, the correct answer is D.

In Linux system management, controlling processes and job execution is a fundamental skill covered extensively in the CompTIA Linux+ V8 objectives. The command shown combines two important concepts: nohup and background execution using & .

The nohup command is used to run a process immune to hangup signals, meaning the process continues running even after the user logs out or the terminal session ends. By default, nohup detaches the process from the controlling terminal and redirects standard output and standard error to a file named nohup.out. When the ampersand ( & ) is appended, the process is immediately placed into the background, allowing the shell prompt to return without waiting for the command to finish.

Linux provides job control mechanisms that allow users to manage background and foreground processes within a shell session. The fg command is specifically designed to bring a background job into the foreground and reattach it to the current terminal. Once a job is in the foreground, it can receive input from the terminal and display output directly, and it can also be interrupted using signals such as Ctrl+C.

The other answer choices do not fulfill this requirement. The renice command is used to change the scheduling priority of a running process but does not affect terminal attachment. The jobs command only lists background and stopped jobs associated with the current shell and does not modify their execution state. The exec command replaces the current shell process with a new process, which is unrelated to resuming or attaching background jobs.

According to Linux+ V8 documentation and job control best practices, the correct command to attach a background process to the current terminal is fg. Therefore, option D is the correct answer.

The correct answer is B. docker image pull debian because it is the standard Docker command used to download container images from a remote repository such as Docker Hub. In Docker terminology, “pulling” an image means retrieving it from a remote registry and storing it locally so it can be used to create containers.

When a user executes docker image pull debian, Docker connects to the default registry (Docker Hub), searches for the official Debian image, and downloads the latest version (by default, the “latest” tag unless otherwise specified). This command is essential in container-based workflows and is commonly used in automation, orchestration, and DevOps environments.

Option A (docker image init debian) is incorrect because there is no valid Docker command called init under docker image. Initialization of containers is handled differently, typically via docker run.

Option C (docker image import debian) is incorrect because import is used to create a Docker image from a local tarball or file, not to download from a remote repository.

Option D (docker image save debian) is incorrect because save is used to export an existing local image into a tar archive for backup or transfer purposes. It does not download images.

From a Linux+ perspective, understanding container management is a key part of automation and orchestration. Commands like docker pull allow administrators to quickly provision environments, deploy applications, and maintain consistency across systems. This makes it a fundamental skill for modern Linux system administration and DevOps practices

Part 1 – Begin the recovery process

Answer:

vgcfgrestore vg01 -f /etc/lvm/archive/vg01_00001-810050352.vg

Part 2 – Continue the recovery process

Answer:

lvchange -ay /dev/vg01/lv01

Part 3 – Complete recovery and access data

Answer:

mount /dev/vg01/lv01 /important_data

This performance-based question tests LVM recovery, a critical System Management skill in CompTIA Linux+ V8. The scenario indicates that a logical volume was removed, but the underlying physical volume and volume group metadata still exist.

???? Part 1: Restoring Volume Group Metadata

The first screenshot shows that:

Physical volumes (pvdisplay, pvs) still exist

The logical volume is missing

/etc/lvm/archive/ contains archived VG metadata

Linux automatically stores backups of LVM metadata in /etc/lvm/archive whenever changes are made. The correct first step is to restore the volume group metadata using:

vgcfgrestore vg01 -f /etc/lvm/archive/vg01_00001-810050352.vg

This restores the logical volume definitions but does not activate them yet.

This is the only correct starting point in Linux+ V8 recovery workflows.

???? Part 2: Activating the Logical Volume

After metadata restoration:

The LV exists but is inactive

blkid shows the LV as TYPE= " LVM2_member "

The logical volume must be activated before it can be mounted:

lvchange -ay /dev/vg01/lv01

This makes the LV available under /dev/vg01/lv01.

Linux+ explicitly requires LV activation after recovery.

???? Part 3: Accessing the Data

The final output shows:

The filesystem type is xfs

The logical volume is now visible

Since there is no indication of filesystem corruption, no repair is required.

The correct final step is to mount the filesystem:

mount /dev/vg01/lv01 /important_data

This restores full access to the underlying data.

Performance troubleshooting in CompTIA Linux+ V8 requires the ability to correlate metrics from tools like top, vmstat, and iostat. In this case, the iostat output provides the most critical data point: %iowait is at 70.38%.

The %iowait metric (also shown as wa in top) represents the percentage of time that the CPU was idle while there were outstanding disk I/O requests. Essentially, the CPU is waiting for the storage subsystem (hard drives or SSDs) to complete read or write operations. A value as high as 70% indicates a severe bottleneck in the storage layer. This " I/O wait " causes the system to feel sluggish or unresponsive because processes are stuck in an uninterruptible sleep state while waiting for data from the disk.

The top output also shows that the overall CPU is 79.2% idle, which confirms that the problem is NOT a lack of computational power (overutilization), making Option B incorrect. The system has 154 zombie processes, which might indicate poorly written software, but zombies themselves do not consume resources or cause slowness. There is no evidence of swap exhaustion (Option A) or a need for patching (Option D) provided in the statistics.

According to Linux+ V8 best practices, when high I/O wait is detected, administrators should investigate disk health, controller performance, or application-level disk usage (e.g., a database performing heavy indexing).

Therefore, high storage I/O latency is the verified explanation for the server slowness.

File and directory management is a core system administration skill addressed in Linux+ V8. When an administrator needs to delete a directory that contains files or subdirectories, a recursive deletion is required.

The correct command is rm -r /home/user1/data. The rm command removes files, and the -r (recursive) option allows it to delete directories and all of their contents, including nested files and subdirectories. This is the standard and correct method for removing non-empty directories.

The other options are incorrect. rmdir -p only removes empty directories and will fail if the directory contains files. ln -d is used to create directory hard links, not remove directories. cut -d is a text-processing command unrelated to filesystem operations.

Linux+ V8 documentation stresses caution when using rm -r, as it permanently deletes data without recovery unless backups exist. Therefore, the correct answer is C.

The SSH configuration option PermitRootLogin prohibit-password prevents the root user from logging in with password authentication. This setting means root cannot use a password to log in via SSH; only key-based authentication is permitted for root. The administrator can still log in as root locally, which is not affected by this SSH configuration. To allow SSH access as root, the administrator must use an SSH key instead of a password.

Other options:

A. MaxSessions controls the number of simultaneous SSH sessions but is not causing the login denial here.

B. PAM (Pluggable Authentication Modules) is disabled, but enabling it is not required for basic SSH authentication.

C. Changing the SSH port is unrelated to the authentication method issue.

Disk encryption is a key Linux+ V8 security objective, especially for protecting data at rest. LUKS (Linux Unified Key Setup) is the standard Linux framework for full-disk and partition-level encryption.

Option B is correct. LUKS provides strong encryption for storage devices, ensuring that data remains unreadable when the system is powered off or the disk is removed. It integrates with tools like cryptsetup and supports key management, passphrases, and multiple unlock methods.

The other options are incorrect. GPG encrypts files, not entire disks. PKI certificates are used for identity and trust, not disk encryption. OpenSSL is a cryptographic library, not a disk encryption mechanism.

Linux+ V8 documentation explicitly identifies LUKS as the primary solution for disk encryption on Linux systems. Therefore, the correct answer is B.

The correct answer is B. find ~ -type d -exec chmod 700 {} ; because it recursively targets all directories within the current user’s home directory and sets their permissions to 700, which restricts access exclusively to the owner.

In Linux permission notation, 700 means:

Owner: read (r), write (w), execute (x)

Group: no permissions

Others: no permissions

This ensures that only the user can access, modify, and traverse the directories, which is a common security requirement for protecting personal or sensitive data. The find ~ -type d portion ensures that only directories (not files) within the user’s home directory are selected. The -exec chmod 700 {} ; part applies the permission change to each directory found.

Option A is incorrect because it applies permissions 777 (full access to everyone) and targets files across the entire filesystem, which is a major security risk.

Option C is incorrect because it sets permissions to 750, which still allows group access. Additionally, it targets all directories under /home, not just the current user’s home directory.

Option D is incorrect because 755 allows read and execute permissions to group and others, meaning directories are not restricted to the user only.

From a Linux+ security perspective, properly managing file and directory permissions is critical to maintaining system confidentiality and integrity. Using chmod 700 ensures strict access control, and combining it with find allows administrators to efficiently enforce secure permissions across directory structures.

This scenario represents a classic DNS troubleshooting situation covered in the Troubleshooting domain of the CompTIA Linux+ V8 objectives. Although the DNS zone file has been updated correctly on the BIND server, the system continues to resolve the domain name to an outdated IP address. This behavior strongly indicates DNS caching rather than a configuration error in the zone file itself.

Modern Linux systems that use systemd-resolved cache DNS responses locally to improve performance and reduce external queries. Even after a DNS record is updated on the authoritative server, cached results may persist until the cache expires or is manually cleared. The nslookup output showing a non-authoritative answer further confirms that the response is being served from a cache rather than directly from the updated zone data.

The correct solution is to flush the local DNS cache so the system can retrieve the updated record from the DNS server. The command resolvectl flush-caches clears all cached DNS entries maintained by systemd-resolved, forcing fresh queries to authoritative name servers. This aligns directly with Linux+ V8 documentation for resolving name resolution inconsistencies caused by stale cache entries.

The other options are incorrect for the following reasons. systemd-resolve query www.abc.com performs a DNS lookup but does not clear cached entries. systemd-resolve status only displays resolver configuration and statistics. service nslcd reload reloads the Name Service LDAP daemon and is unrelated to DNS resolution or caching.

Linux+ V8 emphasizes identifying whether issues originate from services, configuration, or cached data. In this case, flushing the DNS cache is the correct and least disruptive corrective action.

Therefore, the correct answer is D. resolvectl flush-caches.

Archive Tab – Create the archive from Ann’s home directory

Correct Command:

tar -cvf /tmp/ann.tar -C /home/ ann

Extract Tab – Extract the archive into Joe’s home directory

Correct Command:

tar -xvf /tmp/ann.tar -C /home/ joe

This performance-based question tests file archiving and restoration using tar, a core System Management skill in the CompTIA Linux+ V8 objectives. The task requires preserving Ann’s files and placing them correctly into Joe’s home directory.

???? Archive Phase Explanation

The goal of the first step is to archive Ann’s entire home directory without embedding the full path (/home/ann) inside the archive. This is accomplished using the -C option.

Command breakdown:

tar → archive utility

-c → create an archive

-v → verbose output (optional but allowed)

-f /tmp/ann.tar → specifies the archive file

-C /home/ → changes directory before archiving

ann → archives the ann directory only

This results in a clean archive containing Ann’s files without absolute paths, which is best practice and explicitly covered in Linux+ V8 documentation.

???? Extract Phase Explanation

The second step extracts the archived files into Joe’s home directory.

Command breakdown:

-x → extract

-v → verbose

-f /tmp/ann.tar → specifies the archive

-C /home/joe → extracts files directly into Joe’s home directory

This ensures Joe receives Ann’s files correctly under /home/joe/ann or directly under /home/joe depending on post-extraction handling, which matches Linux+ expectations for administrative user transitions.

Container orchestration concepts are part of the Automation and Orchestration domain in Linux+ V8. In Kubernetes, workloads run inside Pods, but Pods are not directly accessible from outside the cluster.

To expose an application externally, a Service resource must be created. Services provide a stable network endpoint and can be configured as NodePort, LoadBalancer, or ClusterIP. Public exposure is typically achieved using NodePort or LoadBalancer types.

Option C, Service, is correct. Deployments manage Pods, but they do not handle networking exposure. Pods represent running containers but lack external accessibility by default. “Network” is not a valid Kubernetes resource type.

Linux+ V8 documentation highlights Services as the mechanism for exposing containerized applications. Therefore, the correct answer is C.

In the context of Linux automation and orchestration, playbooks are most commonly associated with configuration management tools such as Ansible, which is explicitly referenced in the CompTIA Linux+ V8 objectives. Playbooks are written in YAML and are designed to define a series of tasks, configurations, and desired system states that should be applied to one or more Linux systems in a repeatable and automated manner.

A primary use case for playbooks is application deployment and system configuration automation. Playbooks allow administrators to specify tasks such as installing packages, configuring services, managing users, setting permissions, deploying application files, and starting or enabling services. This aligns directly with option A, which accurately describes playbooks as a method to provide a set of tasks and configurations required to deploy an application consistently across environments.

The remaining options are not accurate representations of playbook functionality. Option B refers to version control implementation, which is handled by tools like Git and is not the purpose of playbooks themselves, although playbooks may be stored in version control systems. Option C describes container security information, which is typically managed through container runtime configurations, secrets, or security policies rather than playbooks. Option D refers to storage volume information for a pod, which is specific to Kubernetes manifests and not a general Linux playbook use case.

According to Linux+ V8 documentation, automation tools and playbooks help reduce human error, improve consistency, and support Infrastructure as Code (IaC) practices. Playbooks are a key mechanism for orchestrating multi-step operations across multiple systems, making them essential for modern Linux system administration.

Therefore, the correct answer is A, as it best describes the practical and documented use case for playbooks in a Linux system.

This scenario clearly indicates a memory exhaustion condition, which falls under the Troubleshooting domain of the CompTIA Linux+ V8 objectives. The most critical clue is the log entry stating that mysqld invoked oom-killer.

The OOM (Out-Of-Memory) killer is a Linux kernel mechanism that activates when the system runs critically low on available memory and cannot satisfy memory allocation requests. When this happens, the kernel selects a process—typically one consuming a large amount of memory—and forcibly terminates it to protect overall system stability. In this case, the MySQL daemon (mysqld) was identified as the process responsible for triggering the OOM condition.

The journalctl output explicitly confirms this behavior. Linux+ V8 documentation emphasizes that when the OOM killer is invoked, it is almost always due to physical memory exhaustion or insufficient swap space, not user intervention or application bugs alone. The additional log line showing mems_allowed=0 further supports the conclusion that the process could not allocate memory from available memory nodes.

The fact that uptime -p reports only 2 minutes of uptime strongly suggests that the system was either rebooted automatically or manually following the memory exhaustion event. Systems may reboot as part of recovery procedures after severe resource exhaustion, especially in production environments.

The other options can be ruled out. There is no indication of a user-initiated kill signal, filesystem corruption, or network connectivity issues. Network outages would not generate OOM killer messages, and filesystem errors would appear as I/O or disk-related errors in the logs.

Linux+ V8 best practices recommend addressing OOM issues by increasing system memory, tuning MySQL memory parameters, configuring swap space, or adjusting OOM scoring.

Therefore, the correct explanation is A. The process exhausted server memory.

Disk forensics and malware analysis fall under the Security domain in the CompTIA Linux+ V8 objectives. When analyzing a compromised disk, it is critical to preserve the data exactly as it exists, including unused space, deleted files, and hidden metadata. This requires a block-level copy, not a file-level copy.

The dd command is the correct tool for this task. It operates at a low level, copying raw data from an input device (if=/dev/sdc) directly to an output file (of=/tmp/image) without interpreting filesystem structures. This ensures an exact, bit-for-bit replica of the disk, which is essential for forensic integrity and malware analysis. The bs=8192 option improves performance by specifying a larger block size during copying.

The other options are incorrect. cp -rp copies files and directories but does not capture free space, deleted data, or disk metadata. cpio and tar are archive utilities that operate at the filesystem level and cannot produce a true disk image. These tools also require the filesystem to be mounted and readable, which is not appropriate for forensic preservation.

Linux+ V8 documentation highlights dd as the preferred utility for disk imaging, backups, and forensic investigations. Administrators are also advised to perform such operations on unmounted disks to avoid altering evidence.

Therefore, the correct and best command for creating an exact block-level disk copy is D. dd if=/dev/sdc of=/tmp/image bs=8192.

This performance-based question tests correct use of the tar utility for backup and restore operations, which is part of System Management in CompTIA Linux+ V8. The key detail is that the backup is explicitly described as uncompressed, so the correct archive file must be a plain .tar file rather than .tar.gz, .tgz, or .tar.bz2.

For the backup command, the correct syntax is:

tar -cvf /backups/application.tar -C /opt/ application

Here, -c creates the archive, -v enables verbose output, and -f specifies the archive filename. The -C /opt/ option changes to the /opt/ directory before archiving, and application is then archived relative to that location. This is the correct Linux+ method because it avoids storing unnecessary leading path components in the archive.

For the restore command, the correct syntax is:

tar -xvf /backups/application.tar -C /opt/

Here, -x extracts the archive, -v displays files being restored, and -f identifies the archive file. The -C /opt/ option ensures the archived application directory is restored back into /opt/, recreating /opt/application correctly.

The other file choices such as /backups/application.tar.gz, /backups/application.tgz, and /backups/application.tar.bz2 are incorrect because they indicate compressed backups, which the question specifically rules out. Likewise, options such as -xzvf or -xjvf are used for gzip- or bzip2-compressed archives and would not apply here.

Therefore, the verified correct PBQ answers are:

Backup: tar -cvf /backups/application.tar -C /opt/ application

Restore: tar -xvf /backups/application.tar -C /opt/

The correct answer is B. top because it provides a dynamic, real-time view of running processes and system resource usage. The top command is an essential Linux system monitoring utility that continuously updates information about CPU usage, memory consumption, running processes, load averages, and system uptime. It is widely used by system administrators for performance monitoring and troubleshooting.

When executed, top displays a full-screen interface showing active processes sorted by resource usage (typically CPU by default). It updates at regular intervals, allowing administrators to observe changes in real time. Additionally, it offers interactive features such as sorting processes, killing processes, and filtering output, which enhances system management capabilities.

Option A (ps) is incorrect because although it lists running processes, it provides only a snapshot at a specific moment in time. It does not update dynamically unless repeatedly executed or combined with other tools.

Option C (df) is incorrect because it displays disk space usage of filesystems, not running processes.

Option D (free) is incorrect because it shows memory usage statistics, including total, used, and available memory, but does not display process-level activity.

From a Linux+ perspective, understanding tools like top is crucial under System Management objectives. It enables administrators to monitor system health, identify resource-intensive processes, and take corrective actions when necessary. Real-time monitoring is particularly important in production environments where performance issues must be diagnosed and resolved quickly.

To create an appropriate device label, format and create an ext4 file system on the new partition, you can use the following commands:

To create a GPT (GUID Partition Table) label on the new drive /dev/sdc, you can use the parted command with the -s option (for script mode), the device name (/dev/sdc), the mklabel command, and the label type (gpt). The command is:

parted -s /dev/sdc mklabel gpt

To create a primary partition of 10 GB on the new drive /dev/sdc, you can use the parted command with the -s option, the device name (/dev/sdc), the mkpart command, the partition type (primary), the file system type (ext4), and the start and end points of the partition (1 and 10G). The command is:

parted -s /dev/sdc mkpart primary ext4 1 10G

To format and create an ext4 file system on the new partition /dev/sdc1, you can use the mkfs command with the file system type (ext4) and the device name (/dev/sdc1). The command is:

mkfs.ext4 /dev/sdc1

You can verify that the new partition and file system have been created by using the lsblk command, which will list all block devices and their properties.

Process scheduling and resource management are essential Linux administration skills covered in Linux+ V8. When a process consumes excessive CPU resources, it can negatively impact overall system performance.

The correct solution is to lower the priority of the CPU-intensive task using the renice command. Niceness values influence how much CPU time a process receives relative to others. Increasing the niceness value reduces the process’s priority, allowing other applications to receive CPU resources more fairly.

Option B directly addresses the issue. The other options do not. pidstat monitors processes but does not modify CPU allocation. nohup allows a process to continue running after logout but does not affect scheduling priority. bg resumes a stopped job in the background but does not reduce CPU usage.

Linux+ V8 documentation explicitly references nice and renice for managing CPU contention. Therefore, the correct answer is B.

The correct answer is B. docker run -it ubuntu because it is the standard command used to start an interactive terminal session inside a new Ubuntu container. The docker run command creates and starts a container from a specified image. The -it flags are critical here: -i keeps STDIN open (interactive mode), and -t allocates a pseudo-terminal, allowing the user to interact with the container as if it were a regular shell session.

When executed, Docker will first check if the ubuntu image exists locally. If it does not, Docker will automatically pull it from the default registry (Docker Hub). Once the image is available, the container is launched and provides access to a shell (typically /bin/bash or /bin/sh) inside the Ubuntu environment.

Option A is incorrect because podman pull ubuntu /bin/bash is not valid syntax. The pull command is only used to download images and does not execute a shell.

Option C is incorrect because containerd is a low-level container runtime and is not typically used directly with such syntax to start interactive containers.

Option D is incorrect because runc exec is used to execute commands in an already running container, not to start a new container. Additionally, it requires a container ID rather than an image name.

From a Linux+ perspective, understanding container lifecycle commands is essential for automation and orchestration. The docker run -it command is fundamental for testing, debugging, and interacting with containerized environments, making it a key skill for administrators working with modern infrastructure.

Container lifecycle management is a core topic within the Automation, Orchestration, and Scripting domain of CompTIA Linux+ V8. Administrators must understand the difference between creating containers, starting containers, and executing commands within running containers.

The correct command is docker run -it app-01-image. The docker run command performs three actions at once: it creates a new container from the specified image, starts the container, and optionally attaches the administrator’s terminal to it. The -i option keeps standard input open, while the -t option allocates a pseudo-terminal (TTY). Together, these options allow the administrator to interactively connect to the container immediately after it is created.

The other options are incorrect for the following reasons. docker start is used only to start an existing stopped container and does not create a new container from an image. Additionally, -t and -d are not valid options for attaching an interactive terminal during container startup. docker build is used to build a Docker image from a Dockerfile and cannot be used to create or connect to a container. docker exec is used to run commands inside an already running container and therefore cannot be used to create a container.

Linux+ V8 documentation emphasizes that docker run is the primary command used when administrators want to instantiate containers from images and interact with them. This command is commonly used during testing, development, and troubleshooting workflows.

The correct answer is A. git init because it is the command used to initialize a new local Git repository in a directory. When executed, git init creates a hidden .git directory that contains all the necessary metadata and configuration files required for version control. This action effectively turns the current directory into a Git repository, allowing the user to begin tracking changes.

In a DevOps and automation context, initializing repositories is a foundational task. It enables version control for scripts, configuration files, and infrastructure-as-code, which are critical components in modern Linux environments. Once the repository is initialized, the engineer can proceed with adding files (git add) and committing changes (git commit).

Option B (git clone) is incorrect because it is used to copy an existing remote repository to a local system. It does not create a new repository from scratch but instead duplicates an already initialized one.

Option C (git config) is incorrect because it is used to configure Git settings such as username, email, and preferences. It does not initialize a repository.

Option D (git add) is incorrect because it stages changes for commit within an already initialized repository. It cannot be used before a repository is created.

From a Linux+ perspective, understanding Git operations is essential under automation and orchestration topics. Tools like Git support collaboration, change tracking, and deployment workflows. The git init command represents the starting point for managing code and configuration in a controlled and versioned manner, making it a critical skill for system administrators and DevOps engineers.

Security compliance and vulnerability management are critical components of Linux system administration, and CompTIA Linux+ V8 places strong emphasis on automated security assessment tools. OpenSCAP is specifically designed to address these requirements.

OpenSCAP is an open-source framework that implements the Security Content Automation Protocol (SCAP), a set of standards used for automated vulnerability scanning, configuration compliance checking, and security auditing. It allows administrators to assess Linux systems against established security baselines such as CIS benchmarks, DISA STIGs, and organizational security policies. This makes OpenSCAP the most appropriate tool for automating both compliance and vulnerability management.

The other options serve different security-related purposes but do not fulfill the automation requirement. SELinux is a mandatory access control system that enforces security policies at runtime but does not perform compliance scanning or vulnerability assessments. Nmap is a network scanning and discovery tool used to identify open ports and services, not compliance automation. AIDE (Advanced Intrusion Detection Environment) is a file integrity monitoring tool that detects unauthorized file changes but does not evaluate overall system compliance.

Linux+ V8 documentation highlights OpenSCAP as a tool used to automate security audits, generate compliance reports, and integrate with configuration management workflows. Its ability to standardize security checks across multiple systems makes it essential in enterprise and regulated environments.

Therefore, the correct answer is D. OpenSCAP.

User account information is centrally stored in the system’s account databases, and Linux+ V8 emphasizes the use of standard tools to query this data safely and consistently.

The getent passwd accounting command retrieves the user’s entry from the passwd database, which may be sourced from local files or network services such as LDAP. This entry includes the username, user ID (UID), group ID (GID), home directory, and assigned login shell. Therefore, option A provides all the requested information in a single command.

Option B, id accounting, displays the UID and group memberships but does not show the home directory or assigned shell. Option C is incorrect because /etc/shadow contains password hashes and expiration data, not shell or home directory information. Option D, who accounting, only shows login sessions and does not provide account configuration details.

Linux+ V8 documentation highlights getent passwd as the preferred method for retrieving comprehensive user account information because it works across different authentication backends.

Thus, the correct answer is A.

Firewall configuration is a key topic in the Security domain of CompTIA Linux+ V8. DNS primarily uses UDP port 53, but TCP port 53 is also required for zone transfers, large responses, and certain reliability scenarios. In this case, the administrator explicitly needs to allow DNS over TCP from a specific network.

The correct command is ufw allow 53/tcp from 10.0.0.0/24. This rule allows incoming TCP traffic on port 53 only from the specified subnet, following the principle of least privilege. Linux+ V8 documentation emphasizes restricting firewall rules by source network whenever possible to minimize attack surfaces.

Option A is incorrect because UFW service aliases like dns are not always guaranteed to map explicitly to TCP, and the syntax is incomplete. Option B is invalid because ufw enable is used to enable the firewall globally and does not define rules. Option D disables firewall protections and introduces a major security risk.

Linux+ V8 best practices stress precise, minimal firewall rules instead of broad or disabling actions. Therefore, C is the correct and secure choice.

The correct answer is A. Verify the remote certificate is trustworthy, and add it to the local trusted certificates repository because the error clearly indicates that the system does not recognize the certificate authority (CA) that issued the server’s SSL/TLS certificate. This is a trust issue, not necessarily a problem with the certificate itself.

When wget reports that the certificate “is not trusted” and “does not have a known issuer,” it typically means the CA certificate is missing from the local trust store. The proper and secure resolution is to first validate that the remote certificate is legitimate (for example, confirming it with the issuing authority or organization). Once verified, the administrator should add the CA certificate to the system’s trusted certificate store (e.g., /etc/pki/ca-trust/ or /usr/local/share/ca-certificates/ depending on the distribution) and update the trust database.

Option B is incorrect because using a self-signed certificate introduces additional trust issues and is not appropriate for production environments unless properly managed.

Option C is incorrect because the error message does not indicate that the certificate is expired, only that the issuer is unknown.

Option D is incorrect because using --no-check-certificate bypasses SSL verification entirely, which creates a significant security vulnerability and violates best practices.

From a Linux+ security perspective, maintaining proper certificate validation is essential for secure communications. Administrators must ensure that trusted CAs are properly configured rather than bypassing verification mechanisms.

The correct answer is A. systemctl mask service because masking a service ensures that it cannot be started manually or automatically under any circumstances. When a service is masked, its unit file is linked to /dev/null, effectively making it impossible for systemd to start the service. This is the most appropriate action when permanently decommissioning a service and ensuring that no user or process can restart it.

Option D (systemctl disable service) is a common distractor but is incorrect in this context. Disabling a service only prevents it from starting automatically at boot time; however, users with sufficient permissions can still manually start the service using systemctl start. Therefore, it does not fully meet the requirement of preventing the service from being started again.

Option B (systemctl kill service) is incorrect because it only terminates the currently running instance of the service. It does not prevent the service from being restarted later, either manually or automatically.

Option C (systemctl isolate service) is also incorrect. The isolate command is used to switch the system to a different target (similar to changing runlevels), not to manage the long-term availability of a specific service.

In Linux system administration, particularly within the Linux+ objectives, understanding the difference between stop, disable, and mask is critical. While stopping halts a service temporarily and disabling prevents automatic startup, masking is the strongest control, ensuring the service cannot be activated at all. This makes it the correct and secure choice when decommissioning services in production environments.

Shell scripting is a primary method for automating repetitive tasks in Linux. According to the CompTIA Linux+ V8 scripting objectives, administrators must understand the syntax for various control structures, including loops.

A for loop in Bash and other POSIX-compliant shells has a specific required structure:

The for statement (to define the iteration).

The do keyword (to start the block of commands).

The loop body (the commands to execute).

The done keyword (to terminate the loop block).

In the script provided, the administrator has correctly initiated the loop with for i in ... and opened the execution block with do. However, the script lacks the concluding done token. Without done, the shell interpreter will continue waiting for more input or return a syntax error because it does not know where the loop ends. This is why the script " does not complete " or run correctly.

The other options are related to different control structures. fi (Option A) is the closing token for an if statement, not a for loop. else (Option B) is an optional branch within an if statement. while (Option C) is a different type of loop entirely and is not a required token for a for loop.

Therefore, the missing token is verified as done.