Domain 1: System Management
- The shell is the core interface: redirection sends stdout with '>' (overwrite) or '>>' (append), stderr with '2>', and pipes '|' pass one command's output to the next. Use 'tee' to write to a file and stdout at once, and here-docs (<<EOF) to feed multi-line input.
- Text-processing tools chain together: grep filters lines by pattern, sed edits streams (s/old/new/), awk works on fields ($1,$2), and cut/sort/uniq/tr/wc slice, order, dedupe, translate, and count. These are the backbone of both interactive work and scripts.
- Storage is layered: partitions (fdisk/parted, GPT vs MBR) hold physical volumes, LVM groups them into volume groups and carves out logical volumes you can grow with lvextend + resize2fs/xfs_growfs, and a filesystem (mkfs.xfs/ext4) is mounted via /etc/fstab using a UUID for stability.
- NetworkManager is the standard network stack: 'nmcli con add/mod/up' configures connections persistently, while 'ip addr' and 'ip route' show live state. Name resolution flows through /etc/nsswitch.conf, /etc/resolv.conf (or systemd-resolved), and /etc/hosts.
- Backups use tar for archives (-czf create, -xzf extract), rsync for efficient incremental sync (including over SSH with -avz), and dd for block-level copies. LVM and Btrfs snapshots capture point-in-time state for fast rollback.
- Virtualization on Linux centers on KVM with libvirt: 'virsh' manages guests from the CLI, 'virt-install' builds them, and cloud-init customizes instances on first boot. Containers share the host kernel and are lighter than full VMs.
- Device and hardware inventory comes from lsblk (block devices), lscpu, lspci, lsusb, and the /proc and /sys pseudo-filesystems; udev rules control device naming and permissions, and dmesg shows kernel/hardware messages.
Domain 2: Services and User Management
- Permissions combine the rwx bits for user/group/other. chmod sets them in octal (755 = rwxr-xr-x) or symbolically (u+x, g-w); read=4, write=2, execute=1. On directories, execute grants traversal and read grants listing.
- Special bits extend permissions: SUID (4) runs a file as its owner, SGID (2) runs as the group or forces group inheritance on directories, and the sticky bit (1) on a shared directory (like /tmp) lets only the owner delete their files.
- User administration uses useradd/usermod/userdel and groupadd; account data lives in /etc/passwd, encrypted passwords and aging in /etc/shadow, and group membership in /etc/group. 'usermod -aG group user' appends a supplementary group without dropping existing ones.
- sudo grants controlled privilege escalation. Edit policy only with visudo (which validates syntax) in /etc/sudoers or a file under /etc/sudoers.d; NOPASSWD skips the prompt for specified commands. This is safer than sharing the root password.
- systemd manages services: 'systemctl start/stop/restart' controls running units, 'enable' sets autostart, 'disable' removes it, and 'mask' blocks a unit entirely. 'systemctl enable --now' enables and starts together; journald collects logs viewed with journalctl.
- Package managers differ by family: dnf/yum with rpm on RHEL/Fedora and apt with dpkg on Debian/Ubuntu, plus universal formats flatpak and snap. Query installed packages with 'rpm -qa'/'dpkg -l' and find a file's owner with 'rpm -qf'/'dpkg -S'.
- Containers are managed with podman (or docker): 'podman run -d -p 8080:80 image' launches one, 'podman ps' lists running containers, and 'podman build -t name .' builds from a Containerfile. Rootless podman and Quadlet units let containers run as systemd services.
Domain 3: Security
- SSH key authentication is stronger than passwords: generate a keypair with ssh-keygen, copy the public key with ssh-copy-id (into ~/.ssh/authorized_keys), then harden sshd_config by setting 'PermitRootLogin no' and 'PasswordAuthentication no'.
- PAM (/etc/pam.d) governs authentication policy across module types (auth, account, password, session); pam_pwquality enforces password complexity and pam_faillock locks accounts after repeated failures.
- Host firewalls: firewalld uses zones and 'firewall-cmd --add-service/--add-port --permanent' followed by '--reload'; nftables is the modern packet framework replacing iptables; ufw is the simple Debian/Ubuntu front-end ('ufw allow 22/tcp').
- SELinux enforces mandatory access control with contexts (labels). Check mode with getenforce, fix mislabeled files with 'restorecon -Rv', toggle policy switches with 'setsebool -P', and translate denials into policy with ausearch + audit2allow. AppArmor is the path-based alternative on Debian/SUSE.
- Cryptography tools: GPG encrypts/signs files and email with public/private keys; OpenSSL generates keys, CSRs, and self-signed certificates and inspects TLS; LUKS (cryptsetup) encrypts whole disks; sha256sum verifies file integrity.
- Account security layers policy: password aging with chage, complexity with pwquality, lockout with faillock, and least-privilege sudo scoping. Disable or expire unused accounts and restrict direct root login.
- Compliance and auditing verify posture over time: auditd records security-relevant events (ausearch/aureport), AIDE detects file tampering against a baseline, and OpenSCAP/Lynis assess systems against benchmarks such as CIS.
Domain 4: Automation, Orchestration, and Scripting
- A Bash script starts with a shebang (#!/bin/bash). Variables are set without spaces (name=value) and expanded with $name or ${name}; always quote "$var" to prevent word-splitting. $? holds the last exit status, where 0 means success.
- Control flow uses if/elif/else with test brackets ([ ] or [[ ]]) and operators like -f (file exists), -z (empty string), and -eq/-lt (numeric). Loops include for, while, and until; case handles multiple patterns.
- Robust scripts use functions, positional parameters ($1, $@, $#), command substitution $(...), and 'set -euo pipefail' to fail fast on errors, unset variables, and broken pipelines.
- Scheduling automates recurring work: cron runs jobs on a five-field schedule (min hour day-of-month month day-of-week), 'at' runs a one-off job, and systemd timers (OnCalendar) are a modern, journald-integrated alternative.
- Ansible is agentless orchestration driven by YAML playbooks over SSH. An inventory lists hosts; plays map modules (copy, file, package, service, user) to tasks; idempotency means re-running a playbook changes nothing if the system already matches the desired state.
- Git provides version control for scripts and infrastructure code: 'git add' stages changes, 'git commit -m' records them, 'git push/pull' sync with a remote, and .gitignore excludes files. Branches isolate work before merging.
- Infrastructure as code (declarative tools like Terraform, cloud-init, and Kubernetes manifests) describes desired state rather than steps. Data is exchanged as JSON/YAML and parsed with tools like jq.
- Responsible AI use (new in V8): always review and test AI-generated commands or scripts before running them, never paste secrets, credentials, or personal data into external AI tools, and keep a human in the loop because models can produce confident but incorrect output.
Domain 5: Troubleshooting
- Start monitoring with top/htop for live CPU and memory, free -h for memory and swap, and uptime for load average (compare it against the number of CPU cores). vmstat and iostat expose CPU, memory, and I/O pressure over time.
- journalctl is the primary log tool: '-u <unit>' filters by service, '-b' shows the current boot, '-p err' filters by priority, and '-f' follows live. dmesg shows the kernel ring buffer for hardware and driver messages.
- Storage problems have distinct signatures: 'df -h' shows a full filesystem, but 'df -i' reveals inode exhaustion when space appears free yet writes fail. Repair unmounted filesystems with fsck (ext) or xfs_repair, and check RAID with /proc/mdstat.
- Network troubleshooting works layer by layer: ping tests reachability, ip route checks the default gateway, 'ss -tulpn' lists listening ports, dig/resolvectl isolates DNS from connectivity, and tcpdump captures packets when deeper analysis is needed.
- Security-related failures often trace to SELinux or permissions: a service that works in permissive mode but fails when enforcing points to a labeling issue fixed with restorecon or a boolean; 'Permission denied' points to ownership/mode; check /var/log/secure and faillock for login problems.
- Performance issues need a method: identify the top consumer, then tune. High swap (si/so in vmstat) suggests memory pressure; the OOM killer logs 'Out of memory: Killed process' in dmesg; renice or ionice adjusts priority, and tuned profiles apply workload-appropriate settings.
- A repeatable method beats guessing: reproduce the problem, read the logs, change one variable at a time, and verify. For services, 'systemctl status' plus 'journalctl -xeu <unit>' usually reveals the failed dependency or the port already in use.
CompTIA Linux+ (XK0-006) exam tips
- Practice on the command line in both an RHEL-family (dnf, firewalld, SELinux) and a Debian-family (apt, ufw, AppArmor) system - XK0-006 is deliberately distribution-neutral.
- Memorize permission math (octal to rwx and back) and umask - calculation questions are common and quick points.
- Know the systemd verbs cold: start, stop, enable, disable, mask, and the difference between enable and start.
- Be fluent with podman basics (run, -p, -v, build, ps) since containers are now a first-class topic.
- For scripting, be able to read a short Bash snippet and predict its output or exit status, and recognize idempotency in an Ansible task.
- Learn the responsible-AI guardrails: validate output, protect secrets and PII, and keep a human reviewer - these are testable in V8.
- Troubleshooting questions reward a systematic order: check logs (journalctl), isolate the layer, and change one thing at a time.
Study guide FAQ
What is the difference between XK0-006 and XK0-005?
XK0-006 is the current V8 version of CompTIA Linux+, reorganized into five domains (System Management; Services and User Management; Security; Automation, Orchestration, and Scripting; Troubleshooting). It adds explicit coverage of containers, Ansible-based orchestration, infrastructure as code, and the responsible use of AI tools, while retaining the strong command-line focus of XK0-005.
How many questions are on the Linux+ XK0-006 exam and what is the passing score?
The real exam has a maximum of 90 questions (a mix of multiple-choice and performance-based) with a 90-minute time limit. The passing score is 720 on a scale of 100 to 900.
How much experience do I need for Linux+ XK0-006?
CompTIA recommends about 12 months of hands-on Linux administration experience, roughly equivalent to CompTIA A+, Network+, and Server+ knowledge, though those certifications are not required.
Is Linux+ distribution-specific?
No. Linux+ is vendor- and distribution-neutral. You are expected to work across the major families, so you should know both RHEL-style tooling (dnf, firewalld, SELinux) and Debian-style tooling (apt, ufw, AppArmor).
How does CertGrid help me prepare for XK0-006?
CertGrid provides a large bank of exam-style practice questions mapped to the five XK0-006 domains, each with a detailed explanation and per-option rationale, plus timed practice that mirrors the real exam's weighting so you can find and close gaps before test day.