{ "Customers are unable to send emails to a company’s domain When searching the naming service, they receive the following error message: Which of the following is a valid reason for this error?" }

      
        { "$ dig mx mydomain.com @ns1.mydomain.com\n\n; \u003c\u003c\u003e\u003e DiG 9.16.23 \u003c\u003c\u003e\u003e mx mydomain.com @ns1.mydomain.com\n;; global options: +cmd\n;; connection timed out; no servers could be reached" }

A{ "The root name servers were configured improperly." }
B{ "The queried DNS server is not responding." }
C{ "The dig command fails because of an extra mx at the end." }
D{ "The name entry does not exist." }

Answer: B

{ "The error “connection timed out; no servers could be reached” indicates that the specified DNS server (ns1.mydomain.com) did not respond to the query. This points to a DNS server availability or connectivity issue, not a problem with the command syntax or record existence." }

{ "A systems administrator receives reports about connection issues to a secure web server. Given the following firewall and web server outputs: Which of the following commands best resolves this issue?" }

A{ "ufw disable" }
B{ "ufw allow 80/tcp" }
C{ "ufw delete deny https/tcp" }
D{ "ufw allow 4096/tcp" }

Answer: C

{ "The firewall output shows that port 443/tcp (HTTPS) is explicitly denied, even though the web server is correctly listening on it. Removing the deny rule for HTTPS (ufw delete deny https/tcp) resolves the issue while still keeping the firewall active and secure." }

{ "An administrator updates the network configuration on a server but wants to ensure the change will not cause an outage if something goes wrong. Which of the following commands allows the administrator to accomplish this goal?" }

A{ "netplan try" }
B{ "netplan rebind" }
C{ "netplan ip" }
D{ "netplan apply" }

Answer: A

{ "netplan try applies the new network configuration temporarily and waits for user confirmation. If not confirmed, it automatically reverts, preventing outages from misconfigurations." }

{ "Users cannot access a server after it has been restarted. At the server console, the administrator runs the following commands: Which of the following is the cause of the issue?" }

A{ "The DNS entry does not have a valid IP address." }
B{ "The SSH service has not been allowed on the firewall." }
C{ "The server load average is too high." }
D{ "The wrong protocol is being used to connect to the web server." }

Answer: B

{ "The server is running and responding to pings, and DNS resolves correctly (dig server1 → 192.168.0.2). The ss -lnt output shows SSH (port 22) is listening, but the firewall (firewall-cmd -- list-all) does not list SSH among the allowed services. Therefore, external users cannot connect because the firewall is blocking SSH." }

{ "A Linux administrator just finished setting up passwordless SSH authentication between two nodes. However, upon test validation, the remote host prompts for a password. Given the following logs: Which of the following is the most likely cause of the issue?" }

      
        { "# tail -1 /var/log/audit/audit.log\ntype=AVC msg=audit(1725364812.441:233): avc:  denied  { read } for  pid=2871\n  comm=\"sshd\" name=\"authorized_keys\" dev=\"dm-0\" ino=134\n  scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023\n  tcontext=unconfined_u:object_r:home_root_t:s0 tclass=file permissive=0\n# ls -lZ /root/.ssh/authorized_keys\n-rw-------. 1 root root unconfined_u:object_r:home_root_t:s0 743 Sep  3 08:15 authorized_keys" }

A{ "The SELinux policy is incorrectly targeting the unconfined_u context." }
B{ "The administrator forgot to restart the SSHD after creating the authorized_keys file." }
C{ "The authorized_keys file has the incorrect root permissions assigned." }
D{ "The authorized_keys file does not have the correct security context to match SELinux policy." }

Answer: D

{ "The log shows avc: denied { read } caused by SELinux when sshd tries to access authorized_keys. The file has the wrong SELinux context (unconfined_u:object_r:home_root_t) instead of the expected context for SSH. This mismatch blocks SSH key authentication even though file permissions are correct. Adjusting the SELinux context (e.g., with restorecon) resolves the issue." }

{ "A systems administrator needs to open the DNS TCP port on a Linux system from network 10.0.0.0/24. Which of the following commands should the administrator use for this task?" }

A{ "ufw allow dns/tcp to 10.0.0.0/24" }
B{ "ufw enable 53/tcp from 10.0.0.0/24" }
C{ "ufw allow 53/tcp from 10.0.0.0/24" }
D{ "ufw disable from 10.0.0.0/24" }

Answer: C

{ "The ufw allow 53/tcp from 10.0.0.0/24 command explicitly opens TCP port 53 (DNS) for connections coming from the 10.0.0.0/24 network, which is the correct way to configure this firewall rule." }

{ "A systems administrator is having issues with a third-party API endpoint. The administrator receives the following output: Which of the following actions should the administrator take to resolve the issue?" }

      
        { "$ dig comptia.com\n\n; \u003c\u003c\u003e\u003e DiG 9.16.23 \u003c\u003c\u003e\u003e comptia.com\n;; global options: +cmd\n;; Got answer:\n;; -\u003e\u003eHEADER\u003c\u003c- opcode: QUERY, status: NXDOMAIN, id: 41522\n\n;; QUESTION SECTION:\n;comptia.com.                   IN      A\n\n;; SERVER: 10.255.255.254#53(10.255.255.254)" }

A{ "Open a secure port in the server’s firewall." }
B{ "Request a new API endpoint from a third party." }
C{ "Review and fix the DNS client configuration file." }
D{ "Enable internet connectivity on the host." }

Answer: C

{ "The dig comptia.com output shows NXDOMAIN and that the query is being sent to 10.255.255.254, which is not a valid DNS server. This indicates a misconfigured DNS client configuration (e.g., /etc/resolv.conf). Fixing the DNS settings will allow proper hostname resolution." }

{ "A systems administrator needs to set the IP address of a new DNS server. Which of the following files should the administrator modify to complete this task?" }

A{ "/etc/whois.conf" }
B{ "/etc/resolv.conf" }
C{ "/etc/nsswitch.conf" }
D{ "/etc/dnsmasq.conf" }

Answer: B

{ "The /etc/resolv.conf file defines DNS resolver settings, including the IP addresses of DNS servers that the system should use for hostname resolution." }

{ "An average of one out of three users in a company cannot reach the company website. A Linux administrator determines that one of the three website servers is down. The administrator inspects the DNS configuration for the website and notices the following entry: Which of the following accurately explains the issue?" }

A{ "The DNS configuration is missing corresponding AAAA records and PTR records, and this is causing clients to fail the hostname translation." }
B{ "The administrator has incorrectly configured the DNS server to be an iterative resolver instead of an authoritative resolver." }
C{ "One of the DNS records has not been signed with a DNSSEC-supported key, and this is causing some web browsers to reject the DNS response." }
D{ "DNS returns all three records in a different order each time, and the browser typically uses the first address in the DNS response." }

Answer: D

{ "With multiple A records, DNS performs simple round-robin ordering and returns the records in a different sequence on each query. Most clients try the first address returned—so when the downed server’s IP appears first (about one in three times), those users cannot connect." }

{ "An administrator has generated an RSA SSH key pair to log in to a remote server. After copying the public key and attempting to log in, the administrator sees the following message: admin@192.168.10.50: Permission denied (publickey,password) After seeing the message, the administrator attempts to connect using ssh -v admin@192.168.10.50 and notices the following debug output: debug1: send_pubkey_test: no mutual signature algorithm Which of the following actions should the administrator take first to remediate this issue?" }

A{ "Issue systemctl restart sshd on the local server." }
B{ "Create a new key pair by running ssh-keygen -t ecdsa." }
C{ "Set PermitRootLogin yes in the /etc/ssh/sshd_config file." }
D{ "Update permissions on the /home/admin/.ssh directory to 700 on the remote server." }

Answer: B

{ "The “no mutual signature algorithm” error means the RSA/SHA-1 key type (ssh-rsa) isn’t supported by both client and server. Generating a new key with a modern algorithm (e.g., ssh- keygen -t ecdsa) ensures a mutually supported signature method." }

{ "A Linux administrator is attempting to capture all network traffic coming to the server from the 10.0.6.5 IP address. Which of the following commands should the administrator run on the server to achieve the goal?" }

A{ "tcpdump ip 10.0.6.5" }
B{ "tcpdump net 10.0.6.5" }
C{ "tcpdump host 10.0.6.5" }
D{ "tcpdump addr 10.0.6.5" }

Answer: C

{ "tcpdump host 10.0.6.5 applies a Berkeley Packet Filter that matches any packets to or from the IP 10.0.6.5, capturing all traffic involving that host. The net qualifier is for entire subnets, ip isn’t a valid filter keyword by itself, and addr is not recognized in tcpdump’s filter syntax." }

{ "A systems administrator is working on an SFTP server configuration. Which of the following commands will best enable the connectivity to that service from the 10.10.0.0/24 network?" }

A{ "sudo ufw allow from 10.10.0.0/24 to any port 22" }
B{ "sudo ufw allow in on eth0 to any port 22" }
C{ "sudo ufw allow from 10.10.0.0/24" }
D{ "sudo ufw allow 0:22/tcp from 10.10.0.0" }

Answer: A

{ "The command sudo ufw allow from 10.10.0.0/24 to any port 22 explicitly opens TCP port 22 (used by SFTP/SSH) only for hosts in the 10.10.0.0/24 network." }

{ "A newly hired Linux administrator needs to grant access to the Linux servers by generating a password-protected RSA key of 4096 bytes. Which of the following commands will accomplish this task?" }

A{ "ssh-keygen -RPb 4096" }
B{ "ssh-keygen -t rsa -b 4096" }
C{ "ssh-keygen -k rsa -l 4096 -p" }
D{ "ssh-keygen -t dsa -B 4096" }

Answer: B

{ "The ssh-keygen command is used to generate SSH key pairs. To generate an RSA key with a length of 4096 bits, the correct syntax is: -t rsa: Specifies the type of key to generate, which is RSA. -b 4096: Specifies the number of bits for the key, in this case 4096. By running this command, the user will be prompted to enter a passphrase to password-protect the key, which satisfies the requirement for generating a password-protected RSA key of 4096 bits." }

{ "A user sends a request to access a virtual server via SSH. Which of the following commands is used to open the SSH standard port?" }

A{ "firewalld-cmd --permanent --add-port=22/tcp" }
B{ "iptables-save | grep dport-22/tcp" }
C{ "iptables -A INPUT -p tcp --dport sshd -j ACCEPT" }
D{ "firewalld-cmd --remove-service=ssh --permanent" }

Answer: A

{ "The firewalld-cmd --permanent --add-port=22/tcp command (commonly firewall-cmd) opens TCP port 22 in the permanent firewalld ruleset so that SSH traffic is allowed. After running it, you’d issue firewall-cmd --reload to apply the change." }

{ "Which of the following actions is required to establish passwordless SSH authentication?" }

A{ "Copy the private SSH key to the remote server." }
B{ "Copy the public and private keys to the remote server." }
C{ "Generate public and private keys on the remote server." }
D{ "Copy the public SSH key to the remote server." }

Answer: D

{ "Copying the public SSH key to the remote server’s authorized_keys file is all that’s needed to enable passwordless SSH authentication." }

{ "A systems administrator troubleshoots a connectivity issue and needs to determine whether port 449 is open. Which of the following commands should the administrator use?" }

A{ "ip 1ink 449" }
B{ "dig localhost:449" }
C{ "tracepath local host. 449" }
D{ "ss -an | grep 449" }

Answer: D

{ "This command displays active and listening network sockets, allowing the administrator to verify whether port 449 is open by checking for its presence in the socket list." }

{ "A systems administrator is troubleshooting a network error on a Linux server. Given the following: Which of the following is the reason for the error?" }

A{ "The DNS resolver is not configured." }
B{ "The default route is missing." }
C{ "The wrong netmask is assigned." }
D{ "The network adapter is down." }

Answer: A

{ "The system cannot resolve the hostname because no DNS servers are configured, as indicated by the absence of nameserver entries in the resolver configuration file, even though network connectivity and routing are present." }

{ "A Linux administrator needs to add a new HTTP service on the server. Which of the following commands allows other systems to communicate with the service after the system is restarted?" }

A{ "firewall-cmd --add-service=http --reload" }
B{ "firewall-cmd --add-port=http --complete-reload" }
C{ "firewall-cmd --add-service=http --permanent" }
D{ "firewall-cmd --add-service=http" }

Answer: C

{ "This command adds the HTTP service to the firewall’s permanent configuration, ensuring the rule persists across system restarts and allows other systems to communicate with the service after reboot." }

{ "A systems administrator is configuring new Linux systems and needs to enable passwordless authentication between two of the servers. Which of the following commands should the administrator use?" }

A{ "ssh-keygen -t rsa && ssh-copy-id -i ~/.ssh/id_rsa.pub john@server2" }
B{ "ssh-keyscan -t rsa && ssh-copy-id john@server2 -i ~/.ssh/key" }
C{ "ssh-agent -i rsa && ssh-copy-id ~/.ssh/key john@server2" }
D{ "ssh-add -t rsa && scp -rp ~/.ssh john@server2" }

Answer: A

{ "This command generates an SSH key pair and securely copies the public key to the remote server, enabling passwordless authentication by allowing key-based SSH login between the systems." }

{ "A Linux administrator observes a low network throughput on a Linux system. The Linux administrator gathers the following output: Which of the following is the cause of a low network throughput?" }

      
        { "# ip link show eth0\n2: eth0: \u003cBROADCAST,MULTICAST,UP,LOWER_UP\u003e mtu 9000 qdisc mq state UP mode DEFAULT\n# ping -M do -s 8972 -c 2 10.10.5.20\nPING 10.10.5.20 (10.10.5.20) 8972(9000) bytes of data.\nping: local error: message too long, mtu=1500\nping: local error: message too long, mtu=1500" }

A{ "Hardware limitations" }
B{ "Driver issue" }
C{ "Duplex configuration issue" }
D{ "MTU mismatch" }

Answer: D

{ "The interface is configured with a jumbo MTU, and the ping test with the do-not-fragment flag shows fragmentation errors, indicating that packets larger than the path MTU cannot be transmitted. This MTU mismatch causes fragmentation or dropped packets, resulting in reduced network throughput." }

{ "A systems administrator is experiencing local network connectivity issues. The administrator gathers the following outputs: Which of the following conclusions can the systems administrator make?" }

A{ "The remote server is denying TCP traffic on port 8." }
B{ "The web server must be restarted" }
C{ "The remote server is blocking ICMP requests." }
D{ "The remote server is configured to only use IPv6." }

Answer: C

{ "The ping test shows 100% packet loss, indicating that ICMP echo requests are not being answered, while the HTTP request successfully reaches the server and returns a response. This confirms that the remote server is reachable but is configured to block ICMP requests." }

{ "A Linux administrator notices that an application is having trouble connecting to an external database. Which of the following commands should the administrator use to validate the connection to the remote port exposed by a database server?" }

A{ "dig MX db.complia.org:3306" }
B{ "nc -v db.comptia.org 3306" }
C{ "arp -an | grcp db.comptia.org | grcp 3306" }
D{ "ss -plant | qrep 3306" }

Answer: B

{ "This command tests connectivity to a specific remote host and port, allowing the administrator to verify whether the database service port is reachable from the system." }

{ "An administrator adds new DNS servers to the network environment. Which of the following files should the administrator modify?" }

A{ "/etc/sysctl.conf" }
B{ "/etc/resolv.conf" }
C{ "/etc/host.conf" }
D{ "/etc/nsswitch.conf" }

Answer: B

{ "The /etc/resolv.conf file is used to define DNS name servers that the system uses for hostname resolution, so adding new DNS servers requires modifying this file." }

{ "An administrator is testing whether an application on a server is available remotely under the IP address 192.168.88.188 on port 5000. Which of the following commands should the administrator use to verify the connectivity?" }

A{ "nc -v 192.168.88.188 5000" }
B{ "ssh 192.168.88.188 -Р 5000" }
C{ "tcpdump 'host 192.168.88.188 and port 5000'" }
D{ "traceroute 192.168.88.188:5000" }

Answer: A

{ "The netcat command can actively attempt a TCP connection to a specific IP address and port, making it suitable for verifying whether the application is reachable and listening on port 5000 from a remote system." }

{ "Users are unable to ping hosts on the same network segment using their hostname: # ping host1 ping: host1: Temporary failure in name resolution Users are only able to reach the hosts when using their FQDN, such as host1.comptia.local. A Linux administrator connects to the system and obtains the following output: Which of the following actions should the administrator take to resolve the issue?" }

      
        { "$ cat /etc/resolv.conf\nnameserver 10.10.10.5\nnameserver 10.10.10.6\n$ ping -c 1 host1.comptia.local\nPING host1.comptia.local (10.10.10.41) 56(84) bytes of data.\n64 bytes from host1.comptia.local (10.10.10.41): icmp_seq=1 ttl=64 time=0.412 ms" }

A{ "Add host1.comptia.local. to /etc/hosts.allow" }
B{ "Add the search domain to the network configuration" }
C{ "Add another DNS server entry to /etc/resolv.conf" }
D{ "Add a DNS A record for the specific hosts" }

Answer: B

{ "The system can resolve fully qualified domain names but fails when resolving short hostnames because no DNS search domain is configured. Adding the appropriate search domain allows the resolver to automatically append the domain to short hostnames during name resolution." }

{ "Which of the following commands is used to verify whether a port is open on a remote host?" }

A{ "ip" }
B{ "ping" }
C{ "nc" }
D{ "netstat" }

Answer: C

{ "The nc command can initiate a connection to a specific port on a remote host, making it useful for verifying whether that port is open and reachable over the network." }

{ "Which of the following protocols is used to monitor network devices?" }

A{ "DNS" }
B{ "SNMP" }
C{ "DHCP" }
D{ "SMTP" }

Answer: B

{ "SNMP is used to monitor network devices by collecting status and performance information and allowing centralized management and alerting." }

{ "A Linux administrator is configuring a CUPS print service on a Linux machine and needs to allow only connections from a local network. Which of the following commands should the administrator use?" }

A{ "iptables -A OUTPUT -d 192.168.100.0/24 --sport 631 -p tcp -j ACCEPT" }
B{ "iptables -A OUTPUT -s 192.168.100.0/24 --dport 631 -p tcp -j ACCEPT" }
C{ "iptables -A INPUT -s 192.168.100.0/24 --dport 631 -p tcp -j ACCEPT" }
D{ "iptables -D INPUT -d 192.168.100.0/24 --dport 631 -p tcp -j ACCEPT" }

Answer: C

{ "Allowing access to the CUPS service requires permitting incoming TCP connections to port 631 from the local network. Adding an INPUT rule with the source network and destination port 631 ensures only hosts on that subnet can connect to the print service." }

{ "A systems administrator is investigating bandwidth issues on a Linux file server that should be able to easily exceed 12.5MBps. The administrator inspects the following information: Which of the following is causing the bandwidth issue?" }

      
        { "# ethtool enp1s0f0 | grep -E \"Speed|Duplex|Link detected\"\n        Speed: 100Mb/s\n        Duplex: Full\n        Link detected: yes" }

A{ "The network interface enp1s0f0 is not using FEC mode" }
B{ "The network interface enp1s0f0 has the incorrect queue length configured" }
C{ "The network interface negotiated speed for enp1s0f0 is set too low" }
D{ "The network interface enp1s0f0 has misconfigured the MTU value" }

Answer: C

{ "The interface has negotiated a speed of 100Mbps, which caps throughput to around 12.5MBps under ideal conditions. If the server should exceed that, the link is negotiating at a lower-than- expected speed (for example, it should be at 1Gbps or higher)." }

{ "Users are unable to access a server after it is restarted. However, an administrator is able to connect directly to the server through a console in the server room and sees the following: Which of the following is the most likely reason for this connectivity issue?" }

A{ "The server has no issue with the network and should be restarted to restore functionality" }
B{ "The server networking cable is plugged into the wrong interface and needs to be moved" }
C{ "The server is not able to obtain an IP address from the DHCP server" }
D{ "The server's network card has failed and will need to be replaced with a new networking card" }

Answer: C

{ "The interface has a 169.254.x.x address, which is a link-local address typically assigned when DHCP fails. This indicates the server is not receiving a valid IP address from the DHCP server after the restart." }

{ "System users are being randomly disconnected from a server. The systems administrator inspects the following output: Which of the following should the administrator do to fix the issue?" }

      
        { "# ip -s link show eth0\n2: eth0: \u003cBROADCAST,MULTICAST,UP,LOWER_UP\u003e mtu 1500 qdisc mq state UP mode DEFAULT\n    RX: bytes  packets  errors  dropped overrun mcast\n    884213355  1423119  184223  0       0       914\n    TX: bytes  packets  errors  dropped carrier collsns\n    512338891  1180442  151004  0       0       0\n# ip route\ndefault via 192.168.10.1 dev eth0 proto static metric 100" }

A{ "Assign a proper gateway." }
B{ "Replace the NIC." }
C{ "Increase the ping's TTL." }
D{ "Increase the MTU size." }

Answer: B

{ "The interface shows a very high number of RX and TX errors while the route and gateway are present and the MTU is standard. This points to a physical or hardware problem with the network interface, so replacing the NIC is the best corrective action." }

{ "A Linux administrator updates the DNS record for the company using: cat /etc/bind/db.abc.com The revised partial zone file is as follows: ns1 IN A 192.168.40.251 ns2 IN A 192.168.40.252 www IN A 192.168.30.30 When the administrator attempts to resolve www.abc.com to its IP address, the domain name still points to its old IP mapping: nslookup www.abc.com Server: 192.168.40.251 Address: 192.168.40.251#53 Non-authoritative Name: www.abc.com Address: 199.168.20.81 Which of the following should the administrator execute to retrieve the updated IP mapping?" }

A{ "systemd-resolve query www.abc.com" }
B{ "systemd-resolve status" }
C{ "service nslcd reload" }
D{ "resolvectl flush-caches" }

Answer: D

{ "This scenario represents a classic DNS troubleshooting situation covered in the Troubleshooting domain of the CompTIA Linux+ V8 objectives. Although the DNS zone file has been updated correctly on the BIND server, the system continues to resolve the domain name to an outdated IP address. This behavior strongly indicates DNS caching rather than a configuration error in the zone file itself. Modern Linux systems that use systemd-resolved cache DNS responses locally to improve performance and reduce external queries. Even after a DNS record is updated on the authoritative server, cached results may persist until the cache expires or is manually cleared. The nslookup output showing a non-authoritative answer further confirms that the response is being served from a cache rather than directly from the updated zone data. The correct solution is to flush the local DNS cache so the system can retrieve the updated record from the DNS server. The command resolvectl flush-caches clears all cached DNS entries maintained by systemd-resolved, forcing fresh queries to authoritative name servers. This aligns directly with Linux+ V8 documentation for resolving name resolution inconsistencies caused by stale cache entries." }

{ "A user states that an NFS share Is reporting random disconnections. The systems administrator obtains the following information: Which of the following best explains the symptoms that are being reported?" }

      
        { "# df -h /mnt/nfsshare\nFilesystem              Size  Used Avail Use% Mounted on\n10.20.30.40:/exports    500G  212G  288G  43% /mnt/nfsshare\n# ip -s link show ens192\n2: ens192: \u003cBROADCAST,MULTICAST,UP,LOWER_UP\u003e mtu 1500 qdisc mq state UP mode DEFAULT\n    RX: bytes  packets  errors  dropped overrun mcast\n    2214338812 3391204  248119  0       0       1204\n    TX: bytes  packets  errors  dropped carrier collsns\n    1882114552 2914338  203771  0       0       0" }

A{ "The mount point is incorrect for the NFS share." }
B{ "The IP address of the NFS share is incorrect." }
C{ "The filesystem is nearly full and is reporting errors." }
D{ "The interface is reporting a high number of errors and dropped packets." }

Answer: D

{ "This issue is best analyzed using a layered troubleshooting approach, as recommended in the Troubleshooting domain of CompTIA Linux+ V8. The reported symptom is intermittent or random disconnections from an NFS share, which commonly indicates a network reliability issue rather than a configuration or filesystem problem. The most critical evidence comes from the output of ip -s link show. The network interface enp1s0 is reporting significant numbers of errors and dropped packets on both the receive (RX) and transmit (TX) paths. High packet loss at the network interface level directly affects protocols like NFS, which rely on stable, continuous TCP/IP communication. When packets are dropped or corrupted, NFS clients may experience timeouts, retransmissions, and apparent disconnections. Although the df -h output shows that the NFS filesystem is 95% full, this alone does not typically cause random disconnections. A nearly full filesystem may lead to write failures or performance degradation, but it does not explain intermittent connectivity loss. Linux+ V8 documentation notes that filesystem capacity issues usually present as I/O errors, not transport-layer disconnects." }

{ "A technician wants to temporarily use a Linux virtual machine as a router for the network segment 10.10.204.0/24. Which of the following commands should the technician issue? (Select three)." }

Choose three.

A{ "echo \"1\" \u003e /proc/sys/net/ipv4/ip_forward" }
B{ "iptables -A FORWARD -j ACCEPT" }
C{ "iptables -A PREROUTING -j ACCEPT" }
D{ "iptables -t nat -s 10.10.204.0/24 -p tcp -A PREROUTING -j MASQUERADE" }
E{ "echo \"0\" \u003e /proc/sys/net/ipv4/ip_forward" }
F{ "echo \"1\" \u003e /proc/net/tcp" }
G{ "iptables -t nat -s 10.10.204.0/24 -A POSTROUTING -j MASQUERADE" }
H{ "iptables -t nat -A PREROUTING -j MASQUERADE" }

Answer: ABG

{ "To temporarily configure a Linux virtual machine as a router, the technician must enable IP forwarding and set up iptables rules to allow and masquerade traffic: A. echo \"1\" \u003e /proc/sys/net/ipv4/ip_forward: Enables IPv4 forwarding in the Linux kernel, allowing the VM to forward packets between interfaces. B. iptables -A FORWARD -j ACCEPT: Adds a rule to the iptables firewall to accept all forwarded packets (allows traffic to be routed). G. iptables -t nat -s 10.10.204.0/24 -A POSTROUTING -j MASQUERADE: Sets up network address translation (NAT) for outgoing packets from the 10.10.204.0/24 subnet, masquerading them as if they are coming from the VM's external IP." }

{ "An administrator is investigating the reason a Linux workstation is not resolving the website http://www.comptia.org. The administrator executes some commands and receives the following output: Which of the following is the most likely cause?" }

      
        { "# grep comptia /etc/hosts\n104.18.99.101   www.comptia.org\n# dig +short www.comptia.org\n104.18.98.101\n# curl -I http://www.comptia.org\ncurl: (7) Failed to connect to www.comptia.org port 80: No route to host" }

A{ "The static entry needs to be removed from /etc/hosts." }
B{ "The remote website does not support IPv6, and the workstation requires it." }
C{ "The firewall needs to be modified to allow outbound HTTP and HTTPS." }
D{ "The nameserver in /etc/resolv.conf needs to be updated to 8.8.8.8" }

Answer: A

{ "Because /etc/hosts takes precedence over DNS, the incorrect IP (104.18.99.101) in your hosts file is being used - causing the unreachable error - even though DNS returns a different, valid address. Removing or correcting that entry lets the workstation resolve via DNS properly." }

{ "Which of the following describes how a user's public key is used during SSH authentication?" }

A{ "The user's public key is used to hash the password during SSH authentication." }
B{ "The user's public key is verified against a list of authorized keys. If it is found, the user is allowed to log in." }
C{ "The user's public key is used instead of a password to allow server access." }
D{ "The user's public key is used to encrypt the communication between the client and the server." }

Answer: B

{ "During SSH public key authentication, the server checks if the user's public key is present in the ~/.ssh/authorized_keys file. If the key is found, the server uses it to verify the user's identity by sending a challenge that can only be answered by the corresponding private key. This process does not involve password hashing or using the public key directly for encryption of the communication stream. Instead, the public key is simply used as a reference for authentication." }

{ "A Linux administrator is testing a web application on a laboratory service and needs to temporarily allow DNS and HTTP/HTTPS traffic from the internal network. Which of the following commands will accomplish this task?" }

A{ "firewalld -- add-service=dns, http,https -- zone=internal" }
B{ "iptables -- enable-service='dns|http|https' -- zone=internal" }
C{ "firewall-cmd --add-service={dns, http, https} --zone=internal" }
D{ "systemctl mask firewalld --for={dns, http, https} --zone=internal" }

Answer: C

{ "The correct way to temporarily allow specific services in a particular zone with firewalld is to use firewall-cmd --add-service=service --zone=zone. Multiple services can be specified in curly braces and separated by commas. The correct syntax is: bash CopyEdit firewall-cmd --add-service={dns,http,https} --zone=internal This command will allow DNS (port 53), HTTP (port 80), and HTTPS (port 443) through the firewall for the \"internal\" zone temporarily (for the current runtime session)." }

{ "A Linux administrator attempts to log in to a server over SSH as root and receives the following error message: Permission denied, please try again. The administrator is able to log in to the console of the server directly with root and confirms the password is correct. The administrator reviews the configuration of the SSH service and gets the following output: Based on the above output, which of the following will most likely allow the administrator to log in over SSH to the server?" }

A{ "Log out other user sessions because only one is allowed at a time." }
B{ "Enable PAM and configure the SSH module." }
C{ "Modify the SSH port to use 2222." }
D{ "Use a key to log in as root over SSH." }

Answer: D

{ "The SSH configuration option PermitRootLogin prohibit-password prevents the root user from logging in with password authentication. This setting means root cannot use a password to log in via SSH; only key-based authentication is permitted for root. The administrator can still log in as root locally, which is not affected by this SSH configuration. To allow SSH access as root, the administrator must use an SSH key instead of a password." }

{ "A Linux administrator needs to change the server name to comptia1. Which of the following commands should the administrator use?" }

A{ "export HOSTNAME=comptia1" }
B{ "echo \"comptia1\" \u003e\u003e /etc/resolv.conf" }
C{ "hostnamectl set-hostname comptia1" }
D{ "systemctl daemon-reload -H comptia1" }

Answer: C

{ "The standard tool for managing the system hostname on modern Linux distributions using systemd is hostnamectl. According to the CompTIA Linux+ V8 objectives, the command hostnamectl set-hostname \u003cname\u003e is the correct and permanent way to change the server's identity. When an administrator runs hostnamectl set-hostname comptia1, the utility updates the various types of hostnames recognized by the system: Static Hostname: This is stored in /etc/hostname and persists across reboots. Transient Hostname: A temporary name received via network configuration (like DHCP). Pretty Hostname: A high-level, human-readable name that can include special characters. Using hostnamectl is preferred over manually editing /etc/hostname because it immediately notifies the kernel and running services of the change, often without requiring a reboot to take effect system- wide." }

{ "An administrator is securely mirroring the working development directory to the staging server. Which of the following should the administrator use to accomplish this task?" }

A{ "scp -s /home/dev devs@staging.DevPlace.com:/home/" }
B{ "scp -ps /home/dev devs@staging.DevPlace.com:/home/" }
C{ "rsync -avz /home/dev devs@staging.DevPlace.com:/home/" }
D{ "rsync -an -ssh /home/dev/ devs@staging.DevPlace.com:/home/" }

Answer: C

{ "rsync -avz /home/dev devs@staging.DevPlace.com:/home/ uses rsync’s archive mode (-a) to preserve permissions, ownership, timestamps, and symbolic links; verbose output (-v) so you can monitor progress; and compression (-z) to speed up transfers. By default, rsync operates over SSH, providing a secure, efficient mirror of the /home/dev directory." }

{ "A user test has set up SSH keys for passwordless authentication, but the server is still prompting for a password. Given the following output: Which of the following is the cause of this issue?" }

      
        { "$ ls -l ~/.ssh\ntotal 12\n-rw-------. 1 test test    0 Sep  4 10:21 authorized_keys\n-rw-------. 1 test test 2602 Sep  4 10:18 id_rsa\n-rw-r--r--. 1 test test  571 Sep  4 10:18 id_rsa.pub" }

A{ "The RSA key does not meet the complexity requirements." }
B{ "The passphrase needs to be provided when creating the key." }
C{ "The wrong permissions are set on id_rsa file." }
D{ "The user forgot to add the public key to the authorited_keys file." }

Answer: D

{ "The empty authorized_keys (0 bytes) means SSH has no public key to match, so it falls back to password authentication. Copying id_rsa.pub into ~/.ssh/authorized_keys will resolve the issue." }

{ "When trying to connect from the bastion host to the remote server, a Linux user always forgets to add some required options in the SSH command line. Which of the following is the best way to permanently solve the user's issue?" }

A{ "Write a connection script and put it in the user's home directory." }
B{ "Instruct the user to add the required options to the ~/.ssh/config file" }
C{ "Add the required options to /etc/ssh/sshconfig" }
D{ "Establish an alias for the SSH command with all the required options." }

Answer: B

{ "By defining a Host block with the necessary options in ~/.ssh/config, the user can simply run ssh hostname and SSH will automatically apply those options every time. This is both user‑specific and persistent without resorting to scripts or system‑wide changes." }