CompTIA Linux+ (XK0-006) Study Guide

Domain 1: System Management

Key concepts you must know · 175 practice questions

The shell is the core interface: redirection sends stdout with '>' (overwrite) or '>>' (append), stderr with '2>', and pipes '|' pass one command's output to the next. Use 'tee' to write to a file and stdout at once, and here-docs (<<EOF) to feed multi-line input.
Text-processing tools chain together: grep filters lines by pattern, sed edits streams (s/old/new/), awk works on fields ($1,$2), and cut/sort/uniq/tr/wc slice, order, dedupe, translate, and count. These are the backbone of both interactive work and scripts.
Storage is layered: partitions (fdisk/parted, GPT vs MBR) hold physical volumes, LVM groups them into volume groups and carves out logical volumes you can grow with lvextend + resize2fs/xfs_growfs, and a filesystem (mkfs.xfs/ext4) is mounted via /etc/fstab using a UUID for stability.
NetworkManager is the standard network stack: 'nmcli con add/mod/up' configures connections persistently, while 'ip addr' and 'ip route' show live state. Name resolution flows through /etc/nsswitch.conf, /etc/resolv.conf (or systemd-resolved), and /etc/hosts.
Backups use tar for archives (-czf create, -xzf extract), rsync for efficient incremental sync (including over SSH with -avz), and dd for block-level copies. LVM and Btrfs snapshots capture point-in-time state for fast rollback.
Virtualization on Linux centers on KVM with libvirt: 'virsh' manages guests from the CLI, 'virt-install' builds them, and cloud-init customizes instances on first boot. Containers share the host kernel and are lighter than full VMs.
Device and hardware inventory comes from lsblk (block devices), lscpu, lspci, lsusb, and the /proc and /sys pseudo-filesystems; udev rules control device naming and permissions, and dmesg shows kernel/hardware messages.

Domain 2: Services and User Management

Key concepts you must know · 152 practice questions

Permissions combine the rwx bits for user/group/other. chmod sets them in octal (755 = rwxr-xr-x) or symbolically (u+x, g-w); read=4, write=2, execute=1. On directories, execute grants traversal and read grants listing.
Special bits extend permissions: SUID (4) runs a file as its owner, SGID (2) runs as the group or forces group inheritance on directories, and the sticky bit (1) on a shared directory (like /tmp) lets only the owner delete their files.
User administration uses useradd/usermod/userdel and groupadd; account data lives in /etc/passwd, encrypted passwords and aging in /etc/shadow, and group membership in /etc/group. 'usermod -aG group user' appends a supplementary group without dropping existing ones.
sudo grants controlled privilege escalation. Edit policy only with visudo (which validates syntax) in /etc/sudoers or a file under /etc/sudoers.d; NOPASSWD skips the prompt for specified commands. This is safer than sharing the root password.
systemd manages services: 'systemctl start/stop/restart' controls running units, 'enable' sets autostart, 'disable' removes it, and 'mask' blocks a unit entirely. 'systemctl enable --now' enables and starts together; journald collects logs viewed with journalctl.
Package managers differ by family: dnf/yum with rpm on RHEL/Fedora and apt with dpkg on Debian/Ubuntu, plus universal formats flatpak and snap. Query installed packages with 'rpm -qa'/'dpkg -l' and find a file's owner with 'rpm -qf'/'dpkg -S'.
Containers are managed with podman (or docker): 'podman run -d -p 8080:80 image' launches one, 'podman ps' lists running containers, and 'podman build -t name .' builds from a Containerfile. Rootless podman and Quadlet units let containers run as systemd services.

Domain 3: Security

Key concepts you must know · 137 practice questions

SSH key authentication is stronger than passwords: generate a keypair with ssh-keygen, copy the public key with ssh-copy-id (into ~/.ssh/authorized_keys), then harden sshd_config by setting 'PermitRootLogin no' and 'PasswordAuthentication no'.
PAM (/etc/pam.d) governs authentication policy across module types (auth, account, password, session); pam_pwquality enforces password complexity and pam_faillock locks accounts after repeated failures.
Host firewalls: firewalld uses zones and 'firewall-cmd --add-service/--add-port --permanent' followed by '--reload'; nftables is the modern packet framework replacing iptables; ufw is the simple Debian/Ubuntu front-end ('ufw allow 22/tcp').
SELinux enforces mandatory access control with contexts (labels). Check mode with getenforce, fix mislabeled files with 'restorecon -Rv', toggle policy switches with 'setsebool -P', and translate denials into policy with ausearch + audit2allow. AppArmor is the path-based alternative on Debian/SUSE.
Cryptography tools: GPG encrypts/signs files and email with public/private keys; OpenSSL generates keys, CSRs, and self-signed certificates and inspects TLS; LUKS (cryptsetup) encrypts whole disks; sha256sum verifies file integrity.
Account security layers policy: password aging with chage, complexity with pwquality, lockout with faillock, and least-privilege sudo scoping. Disable or expire unused accounts and restrict direct root login.
Compliance and auditing verify posture over time: auditd records security-relevant events (ausearch/aureport), AIDE detects file tampering against a baseline, and OpenSCAP/Lynis assess systems against benchmarks such as CIS.

Domain 4: Automation, Orchestration, and Scripting

Key concepts you must know · 129 practice questions

A Bash script starts with a shebang (#!/bin/bash). Variables are set without spaces (name=value) and expanded with $name or ${name}; always quote "$var" to prevent word-splitting. $? holds the last exit status, where 0 means success.
Control flow uses if/elif/else with test brackets ([ ] or [[ ]]) and operators like -f (file exists), -z (empty string), and -eq/-lt (numeric). Loops include for, while, and until; case handles multiple patterns.
Robust scripts use functions, positional parameters ($1, $@, $#), command substitution $(...), and 'set -euo pipefail' to fail fast on errors, unset variables, and broken pipelines.
Scheduling automates recurring work: cron runs jobs on a five-field schedule (min hour day-of-month month day-of-week), 'at' runs a one-off job, and systemd timers (OnCalendar) are a modern, journald-integrated alternative.
Ansible is agentless orchestration driven by YAML playbooks over SSH. An inventory lists hosts; plays map modules (copy, file, package, service, user) to tasks; idempotency means re-running a playbook changes nothing if the system already matches the desired state.
Git provides version control for scripts and infrastructure code: 'git add' stages changes, 'git commit -m' records them, 'git push/pull' sync with a remote, and .gitignore excludes files. Branches isolate work before merging.
Infrastructure as code (declarative tools like Terraform, cloud-init, and Kubernetes manifests) describes desired state rather than steps. Data is exchanged as JSON/YAML and parsed with tools like jq.
Responsible AI use (new in V8): always review and test AI-generated commands or scripts before running them, never paste secrets, credentials, or personal data into external AI tools, and keep a human in the loop because models can produce confident but incorrect output.

Domain 5: Troubleshooting

Key concepts you must know · 167 practice questions

Start monitoring with top/htop for live CPU and memory, free -h for memory and swap, and uptime for load average (compare it against the number of CPU cores). vmstat and iostat expose CPU, memory, and I/O pressure over time.
journalctl is the primary log tool: '-u <unit>' filters by service, '-b' shows the current boot, '-p err' filters by priority, and '-f' follows live. dmesg shows the kernel ring buffer for hardware and driver messages.
Storage problems have distinct signatures: 'df -h' shows a full filesystem, but 'df -i' reveals inode exhaustion when space appears free yet writes fail. Repair unmounted filesystems with fsck (ext) or xfs_repair, and check RAID with /proc/mdstat.
Network troubleshooting works layer by layer: ping tests reachability, ip route checks the default gateway, 'ss -tulpn' lists listening ports, dig/resolvectl isolates DNS from connectivity, and tcpdump captures packets when deeper analysis is needed.
Security-related failures often trace to SELinux or permissions: a service that works in permissive mode but fails when enforcing points to a labeling issue fixed with restorecon or a boolean; 'Permission denied' points to ownership/mode; check /var/log/secure and faillock for login problems.
Performance issues need a method: identify the top consumer, then tune. High swap (si/so in vmstat) suggests memory pressure; the OOM killer logs 'Out of memory: Killed process' in dmesg; renice or ionice adjusts priority, and tuned profiles apply workload-appropriate settings.
A repeatable method beats guessing: reproduce the problem, read the logs, change one variable at a time, and verify. For services, 'systemctl status' plus 'journalctl -xeu <unit>' usually reveals the failed dependency or the port already in use.

CompTIA Linux+ (XK0-006) exam tips

Practice on the command line in both an RHEL-family (dnf, firewalld, SELinux) and a Debian-family (apt, ufw, AppArmor) system - XK0-006 is deliberately distribution-neutral.
Memorize permission math (octal to rwx and back) and umask - calculation questions are common and quick points.
Know the systemd verbs cold: start, stop, enable, disable, mask, and the difference between enable and start.
Be fluent with podman basics (run, -p, -v, build, ps) since containers are now a first-class topic.
For scripting, be able to read a short Bash snippet and predict its output or exit status, and recognize idempotency in an Ansible task.
Learn the responsible-AI guardrails: validate output, protect secrets and PII, and keep a human reviewer - these are testable in V8.
Troubleshooting questions reward a systematic order: check logs (journalctl), isolate the layer, and change one thing at a time.

Study guide FAQ

What is the difference between XK0-006 and XK0-005?

XK0-006 is the current V8 version of CompTIA Linux+, reorganized into five domains (System Management; Services and User Management; Security; Automation, Orchestration, and Scripting; Troubleshooting). It adds explicit coverage of containers, Ansible-based orchestration, infrastructure as code, and the responsible use of AI tools, while retaining the strong command-line focus of XK0-005.

How many questions are on the Linux+ XK0-006 exam and what is the passing score?

The real exam has a maximum of 90 questions (a mix of multiple-choice and performance-based) with a 90-minute time limit. The passing score is 720 on a scale of 100 to 900.

How much experience do I need for Linux+ XK0-006?

CompTIA recommends about 12 months of hands-on Linux administration experience, roughly equivalent to CompTIA A+, Network+, and Server+ knowledge, though those certifications are not required.

Is Linux+ distribution-specific?

No. Linux+ is vendor- and distribution-neutral. You are expected to work across the major families, so you should know both RHEL-style tooling (dnf, firewalld, SELinux) and Debian-style tooling (apt, ufw, AppArmor).

How does CertGrid help me prepare for XK0-006?

CertGrid provides a large bank of exam-style practice questions mapped to the five XK0-006 domains, each with a detailed explanation and per-option rationale, plus timed practice that mirrors the real exam's weighting so you can find and close gaps before test day.

Official exam sources

The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.

CompTIA Linux+ (XK0-006) certification pagelink and content verified 8 September 2026Maximum of 90 questions, multiple-choice and performance-based; 90 minutes; "Passing score: 720 (on a scale of 100-900)", which is what our 720/900 label states. Recommended experience: "12 months of hands-on experience with Linux servers; CompTIA A+, Network+, or Server+, or comparable knowledge is recommended" - recommended, not required.

Related Linux resources

Test yourself: 760 CompTIA Linux+ (XK0-006) practice questions