learn/linux-plus
XK0-006 study notes written objective by objective, with cited sources, cross-distribution differences, and practice questions that link back to the material.
81 topics.
Study tools
Study plan
Topics across weeks, with each week returning the following one. Spacing beats cramming.
Objective coverage
All 29 XK0-006 objectives, which are covered, and which are not.
Distribution differences
All 395 differences from the topics, collected in one place. A vendor-neutral exam tests exactly this.
Full practice exam
Weighted to the real domain percentages and timed to 90 minutes.
Practice
Domain 1: System Management
Original practice items written against the published XK0-006 objectives for domain 1. These are not exam questions and no part of them is drawn from any real exam.
Domain 2: Services and User Management
Original practice items written against the published XK0-006 objectives for domain 2. These are not exam questions and no part of them is drawn from any real exam.
Domain 3: Security
Original practice items written against the published XK0-006 objectives for domain 3. These are not exam questions and no part of them is drawn from any real exam.
Domain 4: Automation, Orchestration, and Scripting
Original practice items written against the published XK0-006 objectives for domain 4. These are not exam questions and no part of them is drawn from any real exam.
Domain 5: Troubleshooting
Monitoring, log analysis, and diagnosis across hardware, storage, networking, security, and performance, drawn from objectives 5.1 to 5.5. Original items written from CompTIA's published objectives and Linux documentation. Every question links back to the section that explains it.
Lessons
00Start here
What the CompTIA Linux+ exam is, where Linux came from and why it ended up everywhere, how to work through these lessons, how to set up a machine to practise on, and what is in the track.
linux-plusorientation01The terminal, and how a command works
What the black window actually is, what the prompt is telling you, and the three parts every command is built from. The first thing to learn, and the thing everything else assumes.
linuxlinux-plusshellbeginner02Getting help on any command
How to answer your own questions about a command you have never seen, why the same name can have two completely different manual pages, and how to read a synopsis line.
linuxlinux-plusshellbeginner03Moving around the filesystem
Where you are, how to go somewhere else, and how to describe a location two different ways. Three commands that everything else in this track assumes you can already use.
linuxlinux-plusshellbeginner04Linux fundamentals and the FHS
Where files actually live and why, what the usr-merge changed underneath you, and how to tell which distribution family you are on before you type a command that only works on half of them.
linuxlinux-plusfhsdistributions05Reading and editing files
Look inside a file without opening an editor, then change one line and save it. Plus the four commands that create, copy, rename, and delete, one of which does not ask twice.
linuxlinux-plusfileseditorsbeginner06Users, root and sudo
Why a machine you own tells you permission denied, who root is, and how to borrow root's authority for one command at a time without becoming a hazard.
linuxlinux-plusaccountssudobeginner07Reading and setting permissions
The ten characters at the start of every ls -l line, what each one grants, how to change them in two different notations, and why the execute bit on a directory has nothing to do with running anything.
linuxlinux-pluspermissionssecurity08Installing software
There is no download button. Instead there is a signed catalogue your machine already trusts, three commands that do the same job on different distributions, and a good reason not to curl a binary off the internet.
linuxlinux-pluspackagesbeginner09How Linux boots
The five stages between the power button and the login prompt, what each one hands to the next, and why knowing the order turns an unbootable machine from a mystery into a short list.
linuxlinux-plusbootgrubsystemd10The kernel and modules
Why a Linux kernel can support tens of thousands of devices without being enormous, how drivers get loaded on demand, and the four commands for inspecting, loading, and refusing them.
linuxlinux-pluskernelmodulesdrivers11Hardware and device discovery
You have been handed a server and no documentation. The commands that tell you what CPU, how much memory, which disks, which cards, and whether any of it is real hardware at all.
linuxlinux-plushardwareinventory12Disks, partitions and filesystems
A new disk is attached and nothing can use it. Three separate steps stand between a lump of storage and a directory you can write to, and skipping any of them produces a different confusing error.
linuxlinux-plusstoragefilesystemspartitions13Mounting and fstab
The filesystem exists and you still cannot save anything to it. What mounting actually does, the six fields of /etc/fstab, why you should never name a disk by its device, and the mount options that quietly override file permissions.
linuxlinux-plusstoragemountfstab14LVM
A partition's size is decided when you create it and changing it means moving data. LVM inserts a layer that makes size a runtime decision, and the one step everybody forgets is the one that makes it visible.
linuxlinux-plusstoragelvm15RAID
Disks fail. RAID is how a server keeps running through it, what each level costs you in capacity, and the commands for building an array, breaking one on purpose, and putting it back.
linuxlinux-plusstorageraidmdadm16Network basics: addresses and routes
Two machines on the same desk cannot reach each other and both are configured. The four separate things every host needs, what a subnet mask actually decides, and why the answer is usually the third one.
linuxlinux-plusnetworkingbeginner17Configuring networking
The address is right, the machine works, and after a restart it is gone. Three different systems own network configuration depending on the distribution, and knowing which one is in charge is most of the job.
linuxlinux-plusnetworkingnmclinetplan18Name resolution and DNS
ping 1.1.1.1 works and ping example.com does not, so the network is fine and something else is broken. Where a name actually gets turned into an address, in what order, and why dig and your application can disagree.
linuxlinux-plusnetworkingdns19Shell redirection and pipes
A command printed four thousand lines and you needed six of them. Every program has one way in and two ways out, and once you can point those anywhere, small commands start doing large jobs.
linuxlinux-plusshellpipesredirection20Text processing
A log file has the answer somewhere in it. Six small commands that search, cut, count, and rewrite text, and the pipeline pattern that answers most questions you will ever ask of a log.
linuxlinux-plusshellgrepawksed21The shell environment
The same command, the same machine, and two different results depending on who runs it and how. What the environment is, how a command actually gets found, and which startup file runs when.
linuxlinux-plusshellenvironmentpath22Archiving and compression
Archiving and compressing are two different jobs that tar does in one command. What the flags mean, why the three compressors give wildly different sizes, and the extraction that scatters files across your home directory.
linuxlinux-plustarcompressionbackup23Backup and restore
Every organisation has backups. Rather fewer have restores. What the three backup types actually cost, the rsync flag that decides whether you copied a directory or its contents, and why a backup you have not restored is a hypothesis.
linuxlinux-plusbackuprsyncdd24Virtualization
Six servers on one box, each convinced it owns the hardware. What a hypervisor actually does, how a container differs from a virtual machine in one measurable way, and the four network modes that decide whether anyone can reach the thing.
linuxlinux-plusvirtualizationkvmcontainers25Links, hard and symbolic
Delete a file and it is still there under another name. What a filename actually is, the two kinds of link and how they fail differently, and why half of /bin is a shortcut to somewhere else.
linuxlinux-plusfilesystemlinksinodes26Finding files
Something exists on this server and nobody knows where. One command searches by name, size, age, owner, and permission, runs another command on what it finds, and is one flag away from deleting all of it.
linuxlinux-plusfindsearchfilesystem27Managing users and groups
Creating an account is one command. Doing it so the person can work, the auditor is satisfied, and offboarding is not an archaeology project takes a few more, and one flag that silently destroys group memberships.
linuxlinux-plususersgroupsaccounts28Account files and attributes
Four text files hold every account on the machine. What each field means, how a password is stored so that reading the file does not help, and the difference between an account that is locked and one that is closed.
linuxlinux-plusaccountsshadowsecurity29Processes and signals
A process is running, or sleeping, or dead but still listed. What the state letters mean, why kill is a poor name for a command that mostly asks politely, and the one state where even the unblockable signal does nothing.
linuxlinux-plusprocessessignalsps30Job control and scheduling
Putting a job in the background, keeping it alive after you disconnect, and handing it to something that will run it every night without you. Plus the five fields everyone gets wrong at least once.
linuxlinux-pluscronjobsscheduling31Packages, repositories and signing
Adding a software source means deciding to trust whoever runs it, for every package they will ever ship you. How signing actually works, how to add a repository properly, and how to ask which package a file came from.
linuxlinux-pluspackagesrepositoriesgpg32Common network services
A tour of the services a Linux server usually runs: what each is for, where its configuration lives on each family, and the order to check them in when something between the browser and the disk is not working.
linuxlinux-plusservicesnginxdnsntp33systemd units and services
systemd replaced a pile of shell scripts with a dependency graph. What a unit is, the difference between start and enable that catches everybody once, and how to read a status output that is telling you more than it looks.
linuxlinux-plussystemdservicesunits34systemd targets, timers and the journal
What replaced runlevels, how a timer beats a crontab, and a log query language that answers questions the old text files could not. Plus the four commands that configure a machine's identity.
linuxlinux-plussystemdjournaltimers35Containers: the basics
A container is not a small virtual machine, and the difference is visible in one command. What an image is, what a container is, and the six commands that cover almost everything you will do with them.
linuxlinux-pluscontainerspodmandocker36Container images, volumes and networks
Where a container's writes actually go, why that layer is thrown away on purpose, and how to keep the data that should survive. Plus building an image, and the caching rule that decides whether a rebuild takes two seconds or four minutes.
linuxlinux-pluscontainersvolumesimages37Authentication and PAM
Every login and every password change on this machine is decided by a stack of small modules read top to bottom, in a file named for the service. The four module types, the control flags, how a stack short-circuits, and how to change one without locking everybody out.
linuxlinux-pluspamauthenticationsecurity38Central identity
Local accounts stop working somewhere around the third server. LDAP as a directory you look things up in, Kerberos as tickets that never carry the password, and SSSD as the client that wires both into NSS and PAM.
linuxlinux-plusldapkerberossssdactive-directoryidentity39Logging and auditing
Two logging systems run on every modern Linux machine, and auditd is a third thing that is not logging at all. Which to reach for, how to read a syslog selector, why unrotated logs fill a disk, and what auditd records that nothing else does.
linuxlinux-plusloggingjournaldrsyslogauditdsecurity40Firewall concepts and netfilter
Every Linux firewall is the same kernel machinery underneath. The five points a packet passes through, why the first rule is nearly always about state, and the difference between a packet that bounces and one that vanishes.
linuxlinux-plusfirewallnetfilternftablesnat41firewalld, ufw and nftables
firewalld, ufw, and nftables all write to the same kernel engine. What differs is what counts as a rule and what survives a reboot. Zones, the runtime versus permanent split, ufw's ordered list, and saving an nftables ruleset.
linuxlinux-plusfirewallfirewalldufwnftablesiptables42sudo in depth
The sudoers policy language field by field: who, where, as whom, and what. Why visudo exists, why a drop-in with a dot in its name is silently ignored, and why permitting vi, less, or a wildcard is the same as permitting root.
linuxlinux-plussudosudoersprivilegesecurity43SSH and secure remote access
SSH is two programs on two machines, each with its own configuration and each deliberately quiet about why it said no. Key pairs, the permission rules that silently refuse a good key, and reading the effective configuration instead of arguing about files.
linuxlinux-plussshopensshsecurityremote-access44SELinux
SELinux is a second permission check that runs after the first one passes, and it does not care what the mode bits say. Contexts, labels, booleans, and how to read a denial instead of turning the whole thing off.
linuxlinux-plusselinuxsecuritymac45Hardening a system
Hardening is subtraction. Counting what is actually exposed, finding the programs that run as root no matter who starts them, making a file even root cannot edit, and the kernel switches worth setting.
linuxlinux-plushardeningsecuritysuidsysctl46Password policy and MFA
Length, expiry, reuse, and lockout are four controls in four different places, and none of them is where people look first. chage, passwd -S, pam_pwquality, pam_faillock, a second factor, and why locked is not closed.
linuxlinux-pluspasswordspammfasecurity47Cryptography basics
Hashing is not encryption and there is no way back. What is actually in the shadow file, what a salt is for, why MD5 is broken for one thing and not another, and what a signature proves that a checksum cannot.
linuxlinux-pluscryptographyhashingopensslsecurity48TLS certificates and ACME
A certificate is a public key with a name attached and somebody else's signature over both. Building a two-party PKI from nothing, watching verification fail and then succeed, and why a certificate that renews itself beats one a person remembers.
linuxlinux-plustlspkiopensslcertificatessecurity49Encrypting data at rest
LUKS turns a disk into 16 megabytes of header and a lot of noise. Building an encrypted volume from nothing, what the header holds, why losing it loses everything, and why shred stopped working on SSDs.
linuxlinux-plusencryptionluksgpgsecurity50Compliance, auditing and integrity
Compliance is a demand for evidence rather than assertion. CVE and CVSS, why a version-number scan is wrong on an enterprise distribution, benchmark scanning with OpenSCAP, and proving on disk that nothing has changed.
linuxlinux-pluscomplianceauditingintegritysecurity51Your first shell script
A script is a file containing the commands you already know. The shebang, the execute bit, arguments, and the two habits that separate a script that works from one that works on somebody else's machine.
linuxlinux-plusscriptingbashautomation52Script control flow
Decisions and repetition. Why the square bracket is a command rather than syntax, the numeric and string operators that are not interchangeable, and the loop that runs once when it should run never.
linuxlinux-plusscriptingbashautomation53Scripts that do real work
Functions, parameter expansion, argument parsing, and traps. The pieces that turn a working script into one you can hand to somebody else, and the four ways ordinary filenames break the naive version.
linuxlinux-plusscriptingbashautomation54Python for sysadmins
When a shell script grows structure it cannot carry, Python takes over. The data types worth knowing, why indentation is syntax, and why the system refuses to let you pip install anything.
linuxlinux-pluspythonscriptingautomation55Git: the basics
Version control for people who administer systems rather than write software. The three places a file can be, what a commit actually contains, and the command that gets your work back after you thought you destroyed it.
linuxlinux-plusgitversion-controlautomation56Git branching and collaboration
Branches, merges, and the conflict markers Git writes into your file when it cannot decide. Plus the difference between reset and revert, which decides whether you can safely undo something everybody else already has.
linuxlinux-plusgitversion-controlautomation57Infrastructure as code concepts
Declarative against imperative, what idempotence actually buys you, and why drift is the problem every configuration tool exists to solve. The vocabulary that makes Ansible, Puppet, and OpenTofu comprehensible before you touch any of them.
linuxlinux-plusiacautomationconfiguration-management58Ansible
Ansible needs nothing installed on the machines it manages, which is most of why it won. Inventory, playbooks, modules, facts, and the changed count that tells you whether your automation is safe to run twice.
linuxlinux-plusansibleautomationconfiguration-management59Puppet and OpenTofu
Puppet converges a machine toward a description and keeps it there. OpenTofu creates infrastructure that did not exist and remembers what it made. Neither competes with Ansible, and knowing which question each answers is most of the value.
linuxlinux-pluspuppetopentofuterraformautomation60CI/CD and GitOps
A pipeline is a script that runs on somebody else's machine and is trusted to be honest about failure. GitOps goes one step further and makes the repository the thing reality is compared against. Both ideas are simpler than the tooling around them suggests.
linuxlinux-plusci-cdgitopsdevsecopsautomation61Orchestration
Orchestration is what you reach for when containers have to find each other, survive a crash without you, and be replaced without downtime. Compose, Swarm, and the Kubernetes vocabulary the exam expects, and the ideas underneath, demonstrated on a real machine.
linuxlinux-pluscontainerskubernetesorchestrationcomposeswarm62AI-assisted administration
An assistant that writes shell, YAML, and regex is genuinely useful and is not accountable for what it produces. This is the review habit, the verification commands, the data governance question, and the prompt injection problem, written by one of these things, which is worth bearing in mind.
linuxlinux-plusaiautomationsecuritygovernance63How to troubleshoot
Troubleshooting is a method, not a talent. Symptom to hypothesis to a test that can only come out one way, changing one thing at a time, and reading the error message you were actually given rather than the one you expected.
linuxlinux-plustroubleshootingmethod64Monitoring concepts
Monitoring is the difference between finding out from a dashboard and finding out from a complaint. What to measure, what an SLO actually commits you to, how an agent reports, and why the alert nobody acts on is worse than no alert.
linuxlinux-plusmonitoringobservabilitysnmp65Reading logs to find a cause
Logs are not a wall of text to be scrolled. They are a queryable record with time, severity, and origin attached, and knowing four filters turns half an hour of scrolling into one command that returns six lines.
linuxlinux-plustroubleshootingloggingjournald66Boot failures and recovery
Boot is a chain, and a failure anywhere in it leaves you with a different set of tools. Working out how far it got, editing the kernel command line from the boot menu, and getting a shell on a system that will not start one.
linuxlinux-plustroubleshootingbootgrubsystemd67Filesystem and mount failures
One error message covers a dozen unrelated causes, which is why mount failures feel arbitrary. Decoding what the message does and does not tell you, recovering a filesystem whose superblock is gone, and knowing when a repair tool is the wrong thing to reach for.
linuxlinux-plustroubleshootingfilesystemsstorage68Disk space and inode problems
Two commands answer the question differently because they are measuring different things. Learning which one to believe, and why a filesystem that is one percent full can refuse to create a file, is most of what disk-space troubleshooting is.
linuxlinux-plustroubleshootingstoragefilesystems69Process and service failures
systemd knows whether it started a process. It does not know whether that process is doing its job, and the gap between those two facts is where a whole category of outage lives. Reading a failed unit, a restart loop, and an exit code that names its own cause.
linuxlinux-plustroubleshootingsystemdprocesses70Hardware and kernel issues
Hardware faults do not announce themselves politely. They arrive as kernel messages full of unfamiliar names, and the skill is deciding whether you are looking at a dying disk, a driver that never loaded, or software blaming the wrong thing.
linuxlinux-plustroubleshootinghardwarekernel71Network connectivity troubleshooting
Network faults feel arbitrary until you work the layers in order. Link, address, route, gateway, name, service, and the one distinction that decides where to look next: whether the far end refused you or said nothing at all.
linuxlinux-plustroubleshootingnetworking72DNS and routing problems
The tool you use to test DNS is not the one your application uses, and that single fact explains most name resolution mysteries. Where lookups actually go, why a cache can serve a wrong answer for hours, and how routing faults masquerade as DNS ones.
linuxlinux-plustroubleshootingdnsnetworking73Permission and access troubleshooting
Why a world-readable file still refuses to open, how to read the whole path instead of the last component, and the four causes that produce the same three words.
linuxlinux-plustroubleshootingpermissionsacl74Security and service access problems
The failures that survive a permissions check: a policy denying what the mode bits allow, a certificate that expired on a Sunday, a protocol both ends refuse to speak, and an account that is fine except for the one attribute nobody looked at.
linuxlinux-plustroubleshootingsecurityselinuxtls75CPU and memory performance
Load average does not measure CPU, free memory is not the number you want, and a process that vanished at 3am was probably chosen deliberately by the kernel. The three things people misread most, demonstrated on a machine doing the work.
linuxlinux-plustroubleshootingperformancememory76I/O and network performance
Storage and network problems present as application problems, because the application is where the waiting is visible. Reading iostat properly, separating latency from throughput, and knowing why a device at 60 percent utilisation can already be the bottleneck.
linuxlinux-plustroubleshootingperformancestoragenetworking
Beyond the exam
Not tested, and no practice question points at any of it. These are the things the certification leaves out that you will want on the job.
Where the time actually goes
Topics 75 and 76 give you tools that say a machine is busy. None of them says which function it is busy in. Sampling against tracing, reading a profile, what a flame graph is really showing, and asking the kernel a question no tool has a flag for.
linuxlinux-plusperformancetracingbeyond-the-examWhat a write actually guarantees
This track covers filesystems, journals, LVM, RAID and backups, and never says what write() promises. It promises less than everybody assumes: the call returns while the data is still in memory, and four layers can still lose it.
linuxlinux-plusstoragefilesystemsbeyond-the-examHow upstream becomes your distribution
A scanner says your glibc is years out of date and your vendor says you are patched. Both are reading the same version number and only one of them is reading the changelog. What a release field carries, why distributions work this way, and what it does to vulnerability management.
linuxlinux-pluspackagingsecuritybeyond-the-examThe system you cannot change
Every capture in this track was taken on a machine whose /usr is read-only and whose root filesystem is a directory named after a hash. Image-based systems, what they move where, what they give up, and why servers are drifting this way.
linuxlinux-pluspackagingimmutablebeyond-the-exam