CompTIA Linux+ V8 Exam XK0-006 Practice Questions

Answer : B

The correct answer is B. yum history undo 46 because it directly reverses the specific transaction identified in the YUM history log. In Red Hat-based Linux distributions, the yum history feature allows administrators to view, manage, and undo past package operations. Each transaction is assigned a unique ID, which can be used to reverse changes accurately.

In this scenario, transaction 46 corresponds to the installation of the httpd package. Using the command yum history undo 46 will attempt to revert that exact transaction by removing the installed package and restoring the system to its previous state before that transaction occurred. This method is precise and preferred in environments where maintaining package consistency is critical.

Option A (yum remove httpd) is incorrect because although it removes the httpd package, it does not specifically reference the transaction history. It may not fully revert all dependencies or changes associated with the original installation transaction.

Option C (yum rollback 46) is incorrect because rollback is not a valid YUM command. The correct functionality is handled through the history undo or history rollback syntax, but rollback requires a different format (typically rolling back to a transaction ID, not specifying a single one in this way).

Option D (yum erase 46) is incorrect because erase expects a package name, not a transaction ID. Using a number like 46 would result in an error.

From a Linux+ system management perspective, understanding yum history commands is essential for package management, auditing, and troubleshooting. It allows administrators to safely reverse changes, ensuring system stability and proper configuration management.

Answer : A

The correct answer is A. Verify the remote certificate is trustworthy, and add it to the local trusted certificates repository because the error clearly indicates that the system does not recognize the certificate authority (CA) that issued the server's SSL/TLS certificate. This is a trust issue, not necessarily a problem with the certificate itself.

When wget reports that the certificate ''is not trusted'' and ''does not have a known issuer,'' it typically means the CA certificate is missing from the local trust store. The proper and secure resolution is to first validate that the remote certificate is legitimate (for example, confirming it with the issuing authority or organization). Once verified, the administrator should add the CA certificate to the system's trusted certificate store (e.g., /etc/pki/ca-trust/ or /usr/local/share/ca-certificates/ depending on the distribution) and update the trust database.

Option B is incorrect because using a self-signed certificate introduces additional trust issues and is not appropriate for production environments unless properly managed.

Option C is incorrect because the error message does not indicate that the certificate is expired, only that the issuer is unknown.

Option D is incorrect because using --no-check-certificate bypasses SSL verification entirely, which creates a significant security vulnerability and violates best practices.

From a Linux+ security perspective, maintaining proper certificate validation is essential for secure communications. Administrators must ensure that trusted CAs are properly configured rather than bypassing verification mechanisms.

Answer : B

The correct answer is B. sed -i 's/oldhostname/newhostname/' /etc/configuration.file because the sed (stream editor) command is specifically designed for searching, finding, and replacing text within files, which is exactly the requirement in this scenario. The -i option enables in-place editing, meaning the file is modified directly without needing to create a separate output file.

The substitution expression 's/oldhostname/newhostname/' follows the standard sed syntax, where s stands for substitute. It replaces the first occurrence of oldhostname with newhostname on each line. This is a common and efficient method used by Linux administrators when performing configuration updates across files.

Option A is incorrect because cut is used for extracting sections of text, not replacing content, and piping into vi in this way is not valid for automated editing. Option C is incorrect because it filters lines containing oldhostname and redirects them to a file named newhostname, which does not perform any replacement and also overwrites data. Option D is incorrect because while awk can process text, the syntax shown does not correctly replace text within the file and does not write changes back to the original file.

In Linux+ objectives, mastering tools like sed is essential for automation and scripting tasks. Administrators frequently need to update configuration files programmatically, especially across multiple systems. Using sed ensures accuracy, efficiency, and scalability when performing such repetitive text modifications.

Answer : A

In modern Linux enterprise environments, integrating with Windows Active Directory (AD) is a common requirement for centralized identity management. According to CompTIA Linux+ V8, the System Security Services Daemon (SSSD) is the recommended way to handle authentication and authorization against remote providers like AD or LDAP.

The sssd.conf file (typically located in /etc/sssd/) is the primary configuration file for this service. It contains the essential 'domain configuration details,' including:

The AD domain name.

The authentication provider (e.g., id_provider = ad).

The URI of the domain controllers.

Caching settings for offline login.

SSSD provides a unified interface that manages the communication between the Linux system and the AD domain, simplifying the authentication stack.

The other options are related but do not serve as the primary domain configuration file. krb5.conf (Option B) configures Kerberos, which is used for the underlying ticket-based authentication, but SSSD often manages these details automatically or relies on it as a sub-component. pam.conf (Option C) manages the Pluggable Authentication Modules stack but does not store domain-specific details.

smb.conf (Option D) is the configuration for Samba; while Samba is used for file sharing and can assist in joining a domain, sssd.conf is the verified location for modern identity integration details in Linux+ V8 environments.

Answer : B

The correct answer is B. chmod g+s /shared because setting the setgid (set group ID) bit on a directory ensures that all files and subdirectories created within it inherit the group ownership of the parent directory. This is essential in shared environments where multiple users from the same group need consistent access to files.

When the g+s permission is applied to a directory, any new files created inside that directory automatically belong to the same group as the directory itself, rather than the primary group of the user who created the file. This behavior is critical for collaboration, as it prevents permission conflicts and ensures that all group members can access and modify shared files without needing manual group changes.

Option A (chmod g+w /shared) is partially helpful but insufficient. While it grants write permission to the group, it does not ensure that newly created files will inherit the correct group ownership. Option C is a duplicate of A and also incorrect for the same reason. Option D (chmod g+x /shared) allows group members to traverse the directory but does not provide write access or ensure proper group inheritance.

In Linux+, managing shared directories is an important aspect of system security and user collaboration. The combination of setgid (g+s) and proper group permissions (such as g+rwx) ensures a controlled and functional shared environment. Without setting the setgid bit, users may create files with different group ownerships, leading to access issues and administrative overhead. Therefore, chmod g+s /shared is the correct and most effective solution for maintaining consistent group collaboration.

Answer : D

The correct answer is D. journalctl -u app.service because journalctl is the primary tool used to query and display logs collected by systemd's journal service (journald). The -u option specifically filters logs related to a particular systemd unit, such as app.service. This allows administrators to view all log entries generated by that service, making it the most precise and efficient command for troubleshooting service-related issues.

In modern Linux systems that use systemd, logs are centralized and managed by journald rather than being scattered across multiple log files. Using journalctl -u app.service provides a complete view of the service's lifecycle, including startup messages, errors, warnings, and runtime activity. Additional options like -f (follow logs in real time) or --since can further refine log analysis.

Option A (cat /var/log/messages) is incorrect because it displays general system logs and is not specific to a particular service. Additionally, not all distributions or services log to this file when using systemd. Option B (systemctl status app.service) is partially useful but incorrect because it only shows a brief summary of the service status along with a limited number of recent log entries, not the full log history. Option C (systemd-analyze unit-files app.service) is incorrect because it is used for analyzing unit files and system boot performance, not for viewing logs.

Within Linux+ objectives, the ability to use journalctl effectively is a key troubleshooting skill. It allows administrators to diagnose service failures, monitor behavior, and identify errors quickly. Filtering logs by unit ensures targeted analysis, which is critical in complex systems running multiple services simultaneously.

Answer : C

Firewall management is a core competency in Linux+ V8, and iptables remains a fundamental tool for defining network access rules. In this scenario, the administrator needs to control traffic directed to the local CUPS service. CUPS (Common Unix Printing System) typically listens on TCP port 631.

To allow external clients from a specific network to connect to this server, the rule must be added to the INPUT chain, as the traffic is coming into the host. The correct command is iptables -A INPUT -s 192.168.100.0/24 --dport 631 -p tcp -j ACCEPT.

Breaking down the command:

-A INPUT: Appends the rule to the Input chain (for incoming traffic).

-s 192.168.100.0/24: Specifies the source network that is permitted.

--dport 631: Targets the destination port where the CUPS service is listening.

-p tcp: Specifies the protocol.

-j ACCEPT: Defines the action to take (allow the packet).

The other options are incorrect. Options A and B target the OUTPUT chain, which controls traffic leaving the server; this would not prevent unauthorized incoming connections. Option D uses the -D flag, which is used to delete an existing rule rather than add one, and it also uses the -d (destination) flag incorrectly for a source restriction.

Therefore, Option C is the verified method for implementing this security requirement using iptables.