Free CompTIA Linux+ Sample Questions

Correct answers: B, D — A DHCP server that supplies the client address plus the next-server and boot filename options for the network bootloader; A TFTP server that serves the bootloader, such as pxelinux or grubx64.efi, along with the kernel and initrd files

• A. NIC firmware has no notion of signed manifests or a time source. Time synchronization is not part of the PXE exchange.
• B. The firmware broadcasts a DHCP request and learns its address together with the TFTP server and boot filename. Without these options the client cannot find a bootloader.
• C. PXE firmware discovers its boot server through DHCP options, not DNS SRV records. A repository location is only used later by the installer.
• D. After DHCP, the firmware downloads the network bootloader over TFTP, which then fetches the kernel and initrd. TFTP is the transport used for these early files.
• E. The firmware cannot query a directory service before it has an IP stack and a bootloader. A kickstart file may be fetched later by the installer, but LDAP is not required for PXE.

Correct answer: B — modprobe

• A. insmod loads only the single .ko file it is given and does not resolve dependencies, so it fails with unknown symbol errors when prerequisites are not already loaded.
• B. modprobe reads modules.dep, loads the prerequisite modules first, and then the requested module, which is exactly the automatic dependency handling the technician wants.
• C. depmod generates the modules.dep and alias files that modprobe consults, but it does not load any module itself.
• D. modinfo only prints metadata such as the description, parameters, and dependencies of a module and never loads anything into the kernel.

Correct answer: A — dracut --force --add-drivers "mpt3sas" /boot/initramfs-$(uname -r).img $(uname -r)

• A. dracut is the initramfs generator on current RHEL releases, and --add-drivers adds the named module to the image generated for the given kernel version.
• B. mkinitrd is the legacy tool that modern dracut-based releases no longer ship as a real generator, so this form is not the way to rebuild the image on RHEL 9.
• C. depmod only rebuilds module index files and grub2-mkconfig only regenerates the boot menu, so neither places a driver inside the initramfs.
• D. insmod loads a module into the running kernel and cannot modify an initramfs file, which is a compressed archive built by a separate tool.

Correct answer: D — Add the `nofail` option to the entries so a missing or unreachable mount does not stop the boot

• A. `noauto` prevents mounting at boot altogether and has no retry behaviour; the shares would simply never mount automatically.
• B. The sixth field sets the `fsck` pass order, and NFS shares are never checked by `fsck`, so it has no effect on boot failures.
• C. `ro` makes a mount read-only after it succeeds. It does not change what happens when the device or server is unreachable.
• D. Correct. `nofail` tells systemd that a failed or missing mount is not fatal, so boot continues instead of dropping to emergency mode.

Correct answer: C — Start `iperf3 -s` on the receiving server and run `iperf3 -c <server-ip>` from the sender to report TCP throughput

• A. A flood ping measures ICMP echo rate with tiny packets, which does not represent TCP bandwidth, and it reports round-trip statistics rather than throughput.
• B. `nmap -sT` performs TCP connect scans to find open ports and does not push bulk data, so it reports no throughput figures.
• C. `iperf3` uses a server and client pair that exchange bulk TCP traffic, and the client prints the measured bandwidth per interval and in total.
• D. `ethtool -s` changes link settings such as speed and duplex and does not generate test traffic or print measurements.

Correct answer: D — Add a line to `~/.bash_profile` that sources `~/.bashrc`, since login shells read the profile, not the rc file

• A. `/etc/hostname` holds the system name and is never read as shell configuration. Deleting `.bashrc` would also lose the working aliases.
• B. Renaming the file would not help, and bash reads `~/.profile` only when `~/.bash_profile` and `~/.bash_login` are absent. The aliases still would not load.
• C. `~/.bash_history` stores previously typed commands and is not executed at startup. Placing aliases there has no effect.
• D. An SSH session starts a login shell, which reads `~/.bash_profile` and not `~/.bashrc`. Sourcing the rc file from the profile loads the aliases in both cases.

Correct answer: D — `tar -xzf /backup/full.tar.gz -C /tmp/restore etc/fstab`

• A. GNU tar strips the leading slash when creating the archive, so the member is stored as etc/fstab. A pattern with a leading slash does not match it.
• B. The -t flag only lists matching members and extracts nothing, so /tmp/restore stays empty.
• C. The -j flag treats the archive as bzip2-compressed, but it was gzip-compressed. tar would report that the data is not in bzip2 format.
• D. The -x and -z flags extract a gzip archive, -C changes into the target directory, and the member name etc/fstab matches the stored relative path. Only that file is written.

Correct answers: A, B — Enlarge the virtual disk with qemu-img resize while the VM is off, or with virsh blockresize while it is running; Grow the partition and filesystem inside the guest afterwards, for example with growpart and resize2fs or xfs_growfs

• A. Correct. The image's virtual size must be increased first on the host; this is what makes the larger block device visible to the guest.
• B. Correct. Enlarging the image does not change the guest's partition table or filesystem, so both must be extended from inside the guest.
• C. Incorrect. A snapshot overlay records changes for rollback; it does not enlarge the disk presented to the guest.
• D. Incorrect. convert rewrites the image in another format and never touches the partition layout or the filesystem.
• E. Incorrect. libvirtd never edits the guest partition table, and restarting it does not change the virtual size of the image.
• F. Incorrect. The memory element sets guest RAM, which is unrelated to persistent disk capacity.

Correct answer: B — Run `cp -a /etc/app /backup/` to copy recursively in archive mode, keeping attributes and links unchanged

• A. `-u` only skips files that are up to date; it does not recurse or preserve attributes, and a directory needs `-R` as well.
• B. `-a` is equivalent to `-dR --preserve=all`, so it recurses and preserves mode, ownership, timestamps, and symbolic links as links.
• C. `-L` dereferences symlinks, which replaces links with copies of their targets, and without `-R` it will not copy a directory either.
• D. `cp -r` recurses, but new files get the invoking user's ownership and current timestamps, and symlinks may be followed.

Correct answer: A — `useradd -m -u 2500 -g devs -s /bin/bash priya`

• A. The -m flag creates the home directory, -u sets the UID, -g sets the existing group as the primary group, and -s sets the login shell. Every requirement is met.
• B. The uppercase -M flag suppresses home directory creation, and -G only adds devs as a supplementary group, so the primary group would not be devs.
• C. This creates the home directory, but -g 2500 assigns the primary group by numeric GID 2500, which is not necessarily the devs group.
• D. The uppercase -U flag takes no argument; it creates a user group named after the user. The stray 2500 would be parsed as the username and the command would fail.

Correct answer: D — Run `renice -n 10 -p 4821` to raise the nice value so the export yields CPU time to higher-priority interactive tasks

• A. Incorrect. `nice` only sets niceness when launching a new command; it has no `-p` option for modifying a process that is already running.
• B. Incorrect. A negative nice value raises priority rather than lowering it, so the export would receive more CPU, and only root may assign negative values.
• C. Incorrect. SIGSTOP halts the process completely rather than reducing its share, and `bg` only resumes jobs of the current shell, not arbitrary PIDs.
• D. Correct. `renice` changes the niceness of an already running process, and a higher nice value means a lower scheduling priority, so the export yields CPU to the web application.

Correct answer: D — Run `update-alternatives --config java` as root and pick the entry for OpenJDK 17 from the numbered selection menu.

• A. Overwriting /usr/bin/java bypasses /etc/alternatives, so a later package update can silently restore the old link, and it leaves the alternatives database out of sync.
• B. `hash -r` only clears the shell's cached command paths; it does not change which binary the alternatives symlink chain points to, so version 11 would still be used.
• C. A PATH change in one user's ~/.bashrc affects only that account's shells, not services or other users, so it fails the system-wide requirement.
• D. Correct. `update-alternatives --config` updates the /etc/alternatives symlink for the `java` group, which is what /usr/bin/java resolves to, making 17 the default for every user.

Correct answer: C — Run `nginx -t` to validate the syntax, then `systemctl reload nginx` so workers are replaced gracefully with the new configuration.

• A. A restart stops the master and every worker, which severs in-flight connections, and it is not the only way to apply configuration since nginx can reload gracefully.
• B. `nginx -s quit` shuts down gracefully, but starting a new instance afterwards leaves a gap with no listener; it is also unnecessary because a reload does the swap in place.
• C. Correct. `nginx -t` catches syntax errors before they can break the service, and a reload signals the master to start new workers with the new configuration while old workers finish existing requests.
• D. SIGKILL terminates the master with no cleanup, dropping connections, and may leave stale PID or socket state; it is never a supported way to apply configuration.

Correct answers: D, E — `resolvectl query intranet.example.com`; `resolvectl status`

• A. Incorrect. This sysctl key reports whether IPv4 forwarding is enabled; it is unrelated to name resolution.
• B. Incorrect. `hostnamectl status` shows the hostname, machine ID, operating system and kernel, with no DNS server information.
• C. Incorrect. `timedatectl timesync-status` shows details of NTP synchronization for the system clock, not DNS configuration.
• D. Correct. `resolvectl query` resolves a name through `systemd-resolved` and reports which link and server answered, which tests the resolver path directly.
• E. Correct. `resolvectl status` prints the DNS servers, search domains and DNSSEC settings for the global configuration and for each link.

Correct answer: A — host

• A. Correct: host networking removes network isolation, so the container uses the host's interfaces and ports directly. Port mappings are unnecessary and are ignored.
• B. Incorrect: bridge networking gives the container its own namespace and private subnet behind NAT. Ports must be published to reach it from outside.
• C. Incorrect: macvlan gives the container its own MAC and IP address on the parent interface, in a separate namespace. It does not share the host's network stack.

Correct answer: A — Run journalctl -u sshd.service -b -1 to list only the sshd unit's entries recorded during the previous boot

• A. -u limits output to one unit and -b -1 selects the boot before the current one, which works because the journal is stored persistently. Together they return the sshd messages from the previous boot.
• B. -k restricts output to kernel messages and -b 0 is the current boot. This neither selects sshd nor reaches the previous boot.
• C. -f follows new entries live, much like tail -f. It shows sshd's current activity and does not go back to a prior boot.
• D. -p err filters by priority across all units, and -b with no offset means the current boot. It would miss non-error sshd messages and the earlier boot.

Correct answer: A — ausearch -k identity

• A. ausearch -k identity queries the audit log for events tagged with that key, which is how keys set in audit.rules are used to retrieve events later.
• B. auditctl manages rules and status of the kernel audit system, so it does not search stored log events. It would not return the tagged records.
• C. aureport --failed produces a summary report of failed events and does not filter by key. It would not list the identity-tagged events.

Correct answers: A, B — Run `firewall-cmd --zone=public --add-port=8443/tcp --permanent`, then run `firewall-cmd --reload` to load the stored configuration into runtime; Run `firewall-cmd --zone=public --add-port=8443/tcp`, then run `firewall-cmd --runtime-to-permanent` to save the active runtime state to disk

• A. Correct. The `--permanent` flag writes the port to the stored zone, and the reload then applies the stored configuration to the running firewall. The port is open now and after reboot.
• B. Correct. Adding the port to runtime opens it immediately, and `--runtime-to-permanent` writes the current runtime state to the permanent configuration so it persists.
• C. Incorrect. firewalld requires a protocol suffix such as `/tcp` when adding a port. A bare number is rejected as an invalid port specification.
• D. Incorrect. A `--permanent` change does not touch the running firewall. Without a reload, the port stays closed until the next reload or reboot.
• E. Incorrect. `--add-service` expects a defined service name such as `https`, and 8443 is not one. The command fails with an invalid service error.

Correct answers: A, C — Run setsebool -P httpd_can_network_connect_db on so the allowance survives a reboot.; Run sealert -a /var/log/audit/audit.log to read the analysis that points to the boolean to change.

• A. Correct. setsebool -P changes the boolean persistently, permitting httpd to connect to database ports while the system stays in enforcing mode.
• B. Incorrect. setenforce 0 moves the whole system to permissive mode, which stops enforcement for every domain and does not survive a reboot.
• C. Correct. sealert parses the audit log and suggests remedies, usually naming the boolean that matches the denied access.
• D. Incorrect. File labels such as httpd_sys_content_t govern file access, not outbound network connections, so relabeling a library cannot allow the socket.
• E. Incorrect. semanage fcontext maps file paths to labels; it cannot label a network port, which would need semanage port, and content type is not the fix.

Correct answer: D — Set the login shell to `/bin/rbash` and define `PATH` as the symlink directory in a root-owned profile file the analyst cannot edit

• A. `/sbin/nologin` refuses the login altogether, so the analyst would never reach a prompt. `ForceCommand` runs a single fixed command for SSH sessions and does not give a restricted interactive shell.
• B. `noexec` only stops binaries stored on that mount from being executed. It does not block `cd`, PATH changes, or slash-containing command names, and the approved symlinks point to programs on other filesystems anyway.
• C. A group called `restricted` has no special meaning to the shell. Group membership alone cannot switch on restrictions, and the plain `sh` shell would allow every command the analyst types.
• D. `/bin/rbash` is bash in restricted mode, which forbids `cd`, assigning `PATH`, and commands containing slashes. Pointing `PATH` at the symlink directory from a file the user cannot modify leaves only the approved tools runnable.

Correct answer: C — Run `cryptsetup luksFormat --type luks2 /dev/sdb1`, unlock it with `cryptsetup open`, then create the filesystem on the mapped device.

• A. Incorrect. The `chattr +e` flag only marks extents on ext4 and does not encrypt anything. Native ext4 encryption would need fscrypt, and the drive's raw contents would remain readable.
• B. Incorrect. GPG encrypts individual files or streams and cannot expose a block device as a transparently decrypted filesystem; it provides no loop-device mount integration.
• C. Correct. LUKS2 through `cryptsetup` encrypts the whole block device, and the filesystem is created on the decrypted mapper device, so everything stored on the partition is ciphertext without the passphrase.
• D. Incorrect. Reading and writing the same device with `openssl enc` corrupts the data while it is being processed, and the result is a raw encrypted blob with no mountable filesystem or key management.

Correct answer: C — Patch the two critical items first, because a CVSS score near 10 on an exposed service signals easy, high-impact exploitation

• A. Counting findings does not measure risk. Eight low-severity CVEs on an internal-only service together carry far less exposure than two critical issues reachable from the internet.
• B. Alphabetical ordering has no relation to severity or exposure. Remediation order should come from CVSS scores combined with how reachable the vulnerable service is.
• C. CVSS rates how severe a CVE is, and a 9.8 on an internet-facing service combines high impact with high exposure. Patching those two first reduces the most risk with limited time.
• D. Every scanner finding that references a CVE already maps to a published entry with a CVSS score. Waiting for extra advisories delays remediation and leaves critical exposure open.

Correct answer: D — A GitOps controller such as Argo CD or Flux that continuously reconciles live objects against the repository

• A. Incorrect: a scheduled push from one laptop is not continuous reconciliation, and drift between runs stays in place.
• B. Incorrect: a one-time push per release does not watch the cluster, so manual changes remain until the next release.
• C. Incorrect: documentation after the fact leaves Git out of the control loop and permits exactly the drift GitOps removes.
• D. Correct: GitOps treats Git as the source of truth, and an in-cluster controller pulls manifests and corrects deviation automatically.

Correct answer: D — #!/usr/bin/env bash

• A. Without the exclamation mark the line is only a comment, so the kernel does not recognise an interpreter and the current shell runs the file.
• B. The sequence $! expands to the PID of the last background job and has no meaning as the first two bytes of an executable script.
• C. Reversing the characters to !# is not a recognised magic number, so the kernel will not treat the line as an interpreter directive.
• D. The #! interpreter directive followed by env lets the kernel use env to search PATH for bash, which is a portable way to select the interpreter.

Correct answer: B — `False`

• A. Incorrect. Only non-empty strings are truthy, and an empty string has no characters.
• B. Correct. Empty strings, empty lists and dictionaries, `0` and `None` all evaluate as false in a Boolean context.
• C. Incorrect. `bool()` always returns either `True` or `False`, never `None`.

Correct answers: A, C — Run `git rebase main` while `feature/api` is checked out to replay the local commits on top of the current tip of `main`.; After resolving a conflict, stage the files with `git add` and run `git rebase --continue` to proceed to the next commit.

• A. Correct. Rebasing rewrites the local commits so they start from the latest `main`, which yields a linear history without a merge commit.
• B. Incorrect. A merge never rewrites existing commits. It adds a merge commit that joins the two histories, so the result is not linear.
• C. Correct. During a rebase each conflicting commit stops the replay, and staging the resolution followed by `--continue` lets Git finish that commit and move on.
• D. Incorrect. Rebasing published commits changes their hashes and diverges from teammates' copies, and a plain push is rejected as non-fast-forward.
• E. Incorrect. `git rebase --abort` cancels the whole rebase and restores the branch to its original state, discarding the conflict resolution already done.

Correct answer: B — Use the approved internal gateway for the task, and ask the security team to review the request if the gateway lacks a needed feature.

• A. Internal hostnames reveal network layout, and renaming the company does not remove them. Hostnames can be sensitive, and the policy still requires the approved gateway.
• B. Following corporate policy means using the approved gateway, and escalating missing capabilities to the security team keeps the work compliant while addressing the usability gap.
• C. Corporate policy applies to company data regardless of which device processes it. Using a personal laptop only hides the violation and moves the data further from organizational control.
• D. A draft produced by an unapproved tool still involves sending internal data to it. Concealing this from others makes the policy breach worse.

Correct answer: C — Compare output with the original on representative data, benchmark both versions, and review it like any other code change.

• A. Speed says nothing about correctness. A faster rewrite can drop edge cases such as unusual delimiters or empty fields while still completing quickly.
• B. A model's assurance is not verification. Behavior changes must be demonstrated by tests, not by the generating tool's own statement.
• C. Comparing outputs on representative data confirms the optimization preserves behavior, benchmarking confirms the gain, and code review applies normal quality assurance to AI-generated changes.
• D. Keeping the change out of version control removes traceability and review. It prevents the comparison that responsible use of AI-driven optimization requires.

Correct answers: B, E — Use SNMPv3 with the authPriv security level so that requests are authenticated and the payload is encrypted in transit; Restrict each SNMP agent to accept requests only from the monitoring server IP address using access control or firewall rules

• A. Incorrect. Write access lets an attacker or mistake change device configuration; monitoring only needs read access.
• B. Correct. SNMPv3 authPriv adds per-user authentication and encryption, unlike community strings which travel in clear text.
• C. Incorrect. The default `public` string is widely known, and SNMPv2c sends it unencrypted, so anyone on the path can read it.
• D. Incorrect. Exposing every object to all accounts widens the information an attacker can collect; views should be limited to what monitoring needs.
• E. Correct. Limiting accepted sources shrinks the exposure, so only the monitoring server can query the agent.

Correct answer: A — Reseat the power cords and test each power supply, since a failed PSU or loose cord leaves the whole chassis, BMC included, unpowered.

• A. With no fans, LEDs, or BMC standby power, the fault is in the power path. Cords and PSUs are the cheapest first checks.
• B. GRUB runs only after firmware has started the CPU. It cannot stop a chassis from receiving power.
• C. Logs are written by a running OS and cannot be read from a machine without power. They also would not explain a dead BMC.
• D. Filesystem state is irrelevant before the hardware powers on. fsck needs a running system.

Correct answers: A, B — Run `ps -eo state,pid,wchan:20,cmd` and filter `D` state to see where tasks are blocked in the kernel; Run `iostat -x 1` to look for devices with high `await` or `%util` that may be stalling those tasks

• A. Correct. Listing `D`-state tasks with their wait channel shows exactly where in the kernel they are blocked, such as a filesystem or NFS call.
• B. Correct. High `await` or `%util` on a device confirms that storage latency is stalling the blocked tasks.
• C. Incorrect. Clock offset reported by chrony does not change how many tasks are runnable or blocked.
• D. Incorrect. `ulimit -a` shows resource limits for the shell and is not a measurement of load average.
• E. Incorrect. The hostname has no relation to I/O scheduler selection or to why processes are blocked.

Correct answer: C — Run `ping -M do -s 1472 10.20.0.5` and lower the size step by step until replies return, revealing the usable path MTU

• A. Incorrect. Forcing speed and duplex addresses link negotiation faults, which would also hurt small packets and SSH. The symptom of only large packets failing points to size limits instead.
• B. Incorrect. Flushing resolver caches only affects name lookups, and the connection already works by address. Name resolution has no effect on packets of a particular size being dropped.
• C. Correct. Setting the don't-fragment flag with a large payload shows where packets stop passing, which exposes an MTU mismatch caused by tunnel overhead. Small pings and SSH work because their packets fit.
• D. Incorrect. Neighbor entries only map next-hop addresses to MAC addresses, and small packets already reach the same next hop. A stale ARP entry would not break only large transfers.

Correct answer: B — The rule was added only to the runtime configuration, so it must be repeated with `--permanent` and reloaded to survive

• A. Incorrect. Service definitions ship with firewalld and persist across reloads. Mixing in raw iptables rules is neither required nor how the permanent state is kept.
• B. Correct. Without `--permanent`, firewalld changes apply only to the running state. A reload rebuilds rules from the saved configuration, which does not contain the service.
• C. Incorrect. An ACCEPT target would permit traffic rather than block it. Zone targets are also unchanged by a reload and do not break TLS handshakes.
• D. Incorrect. The trusted zone accepts all traffic, so moving to it would open ports instead of closing them. The zone assignment is not what changed.

Correct answers: A, D — Copy the internal root CA certificate to /etc/pki/ca-trust/source/anchors/ and run `update-ca-trust` for system-wide trust; Check the chain with `openssl s_client -connect intranet.example.com:443 -showcerts` and have the server send its intermediate

• A. Correct. Placing the private root CA in the anchors directory and running `update-ca-trust` makes it trusted system-wide for TLS clients.
• B. Incorrect. Crypto policies restrict algorithms and protocols and never add trusted issuers.
• C. Incorrect. That enables client certificate authentication, which does not supply the missing issuer the client needs for chain validation.
• D. Correct. A server that omits the intermediate CA forces clients to find the issuer on their own, which produces this error.
• E. Incorrect. A new key does not change the issuer chain, and a certificate must be re-issued by the CA to match any new key.

Correct answer: A — semanage fcontext -a -t

• A. Correct. `semanage fcontext` stores a file context rule in the policy, which `restorecon` uses to apply the label persistently.
• B. Incorrect. `chcon` changes a label directly on disk and does not record anything, so a relabel discards it.
• C. Incorrect. `setsebool` toggles policy booleans and does not define file labels.