Overview
Services and User Management carries 20% of the XK0-006 exam across six objectives. It covers file and directory utilities and link types, local account lifecycle with useradd, usermod, passwd and chage plus the /etc/passwd, /etc/shadow and /etc/group files, process inspection, priority, signals and job control, cron, at and anacron scheduling, package and repository management including GPG signatures, exclusions and update alternatives, basic configuration of common services such as DNS, NTP, DHCP, HTTP and mail, systemd unit management, and running applications in containers with Podman or Docker.
The domain exists because a server's purpose is the workloads and users it supports. It sits directly on Domain 1's storage and network foundation, Domain 3 then locks these accounts, services and containers down, and Domain 4 automates the same tasks through scripts and orchestration.
How it's tested
Expect task-based scenarios: a user needs access, a service must start at boot, a process is hung, a package must stay at its current version, or a container cannot reach its data. The right answer is the command and option that meets the requirement exactly, with no side effect such as wiping a user's existing groups or restarting a live service unnecessarily.
-
Exact option matters
Several options use the same command with different flags, such as usermod -G versus usermod -aG. Only one meets the requirement without collateral damage.
-
Persistent versus immediate
The scenario asks for a change now, at boot, or both; you distinguish start from enable, crontab from at, and runtime from saved settings.
-
Least disruptive action
A running service or process needs attention; the best answer escalates gently, such as reload before restart and SIGTERM before SIGKILL.
A developer must join the docker group without losing membership in wheel and dev. Options include usermod -G docker and usermod -aG docker. Both add docker, but -G alone replaces the supplementary group list, silently removing wheel and dev. The requirement to keep existing access makes -aG the only correct choice, and the user must log in again before the new membership applies.
Objectives 6
Official objectives from the CompTIA outline, in outline order.
2.1 Given a scenario, manage files and directories on a Linux system.File utilities, hard and symbolic links, and device file types.
- What it means
- Covers navigation and manipulation (ls, cd, cp, mv, rm, mkdir, rmdir, touch, stat, file), comparison (diff, sdiff), searching (find, locate), open-file inspection with lsof, hard versus symbolic links with ln, and block, character and special character devices in /dev.
- What to understand
- A hard link is another name for the same inode, so it survives deletion of the original name but cannot cross filesystems or point to a directory. A symbolic link stores a path, can cross filesystems, and breaks when the target moves. locate searches a prebuilt database and can be stale; find searches live and can filter by size, age, owner or permission.
- How it shows up
- A file deleted while a process still holds it open keeps consuming space; lsof shows the culprit. Or you pick find with the right tests, such as -mtime +30 -size +100M.
- Common confusion
- Expecting locate to find a file created minutes ago. Its database is refreshed by updatedb, usually on a schedule.
2.2 Given a scenario, perform local account management in a Linux environment.Creating, modifying, locking, expiring and listing local users and groups.
- What it means
- Covers useradd/adduser, usermod, userdel/deluser, groupadd, groupmod, groupdel, passwd, chage and chsh; the account files /etc/passwd, /etc/shadow and /etc/group; profile templates in /etc/skel and /etc/profile; identity attributes UID, GID, EUID and EGID; and user versus system and service accounts.
- What to understand
- useradd -m copies /etc/skel into the new home directory. passwd -l or usermod -L locks the password only, while chage -E 0 expires the whole account. Password hashes and ageing data live in /etc/shadow, readable only by root; /etc/passwd holds the shell and home path. System and service accounts use low UIDs and usually a nologin shell.
- How it shows up
- You are asked to disable a departing employee's access without deleting files, force a password change at next login (chage -d 0), or audit who logged in recently (last, lastlog).
- Common confusion
- Treating a password lock as a full lockout. A user with SSH keys may still get in, so expiring the account or setting a nologin shell is stronger.
2.3 Given a scenario, manage processes and jobs in a Linux environment.Inspecting processes, priorities, signals, job control and scheduling.
- What it means
- Covers process inspection (ps, top, htop, atop, pstree, pidstat, mpstat, strace, lsof, /proc/PID), PIDs and PPIDs, states (running, sleeping, blocked, stopped, zombie), nice and renice, process limits, job control (&, bg, fg, jobs, Ctrl+z, nohup), signals 1 HUP, 9 KILL and 15 TERM, and scheduling with crontab, at and anacron.
- What to understand
- SIGTERM (15, the kill default) asks a process to exit cleanly; SIGKILL (9) cannot be caught and skips cleanup; SIGHUP (1) makes many daemons reload configuration. Niceness runs from -20 (highest priority) to 19, and only root can lower it. A zombie has already exited and cannot be killed; its parent must reap it. anacron runs jobs missed while a machine was off; cron does not.
- How it shows up
- A hung application, a CPU hog that must keep running at lower priority, or a nightly job on a laptop that is often powered off at the scheduled time.
- Common confusion
- Sending kill -9 to a zombie, or reaching for SIGKILL first and losing data a clean shutdown would have saved.
2.4 Given a scenario, configure and manage software in a Linux environment.Packages, repositories, GPG signatures, exclusions, alternatives and common service setup.
- What it means
- Covers installing, updating and removing software with package managers (dnf/yum, apt, zypper) and language managers (pip, cargo, npm), resolving dependencies and conflicts, enabling, disabling and adding third-party repositories, verifying GPG signatures, excluding packages from updates, managing update-alternatives, sandboxed applications, and basic configuration of DNS, NTP/PTP, DHCP, Apache httpd or Nginx, SMTP and IMAP4 services.
- What to understand
- High-level managers such as dnf and apt resolve dependencies from repositories; low-level rpm and dpkg install a single file and do not. A repository's GPG key must be trusted before its signed packages install cleanly. Version pinning uses an exclude entry in dnf configuration or apt-mark hold. update-alternatives switches which binary a generic name, such as java or editor, points to.
- How it shows up
- An update must not touch a specific kernel or database package, a third-party repository fails with a signature error, or two installed versions compete for the same command name.
- Common confusion
- Disabling GPG checking to make an install succeed. The correct fix is importing the vendor's key, because the check is what proves the package was not tampered with.
2.5 Given a scenario, manage Linux using systemd.Unit types, systemctl state management and systemd utilities.
- What it means
- Covers service, timer, mount and target units; systemctl actions (start, stop, restart, reload, status, enable, disable, mask, unmask, edit, daemon-reload); and related tools such as systemd-analyze blame, hostnamectl, timedatectl, resolvectl, systemd-resolved and sysctl.
- What to understand
- start and stop take effect immediately; enable and disable control boot behaviour, and enable --now does both. mask links a unit to /dev/null so nothing, not even a manual start or a dependency, can launch it. After editing a unit file, run daemon-reload before restarting. systemctl edit creates a drop-in override so package updates do not overwrite your change. sysctl settings persist only when written to /etc/sysctl.d.
- How it shows up
- A service runs now but not after reboot, a unit edit seems ignored, a conflicting service keeps being pulled in by another unit, or boot is slow and you need the unit responsible.
- Common confusion
- Using disable to stop a service from ever running. A disabled unit can still start manually or as a dependency; mask is the hard block.
2.6 Given a scenario, manage applications in a container on a Linux server.Runtimes, images, Dockerfiles, container operations, volumes, networks and privilege.
- What it means
- Covers container runtimes (runC, containerd, Docker, Podman), pulling, building, tagging and pruning images, Dockerfile instructions FROM, USER, CMD and ENTRYPOINT, running, inspecting, exec-ing into and reading logs of containers, environment variables, volumes and their SELinux context, network types (bridge, host, none, macvlan, ipvlan, overlay) with port mapping, and privileged versus unprivileged containers.
- What to understand
- ENTRYPOINT fixes the executable; CMD supplies default arguments that docker run or podman run can override. Containers are ephemeral, so data must live on a volume or bind mount. On SELinux hosts, adding :Z or :z to a bind mount relabels it so the container can access it. Host networking shares the host's network stack, so port mapping does not apply. Podman runs without a central daemon and supports rootless containers.
- How it shows up
- A container cannot write to a bind-mounted directory on an SELinux host, data disappears after the container is recreated, or a service in a container is unreachable because no port was published.
- Common confusion
- Fixing an SELinux denial on a volume by running the container privileged. Relabelling the volume solves it without handing the container broad host access.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Hard link versus symbolic link
A hard link is a second directory entry for the same inode, while a symbolic link is a small file that stores a path to its target.
- Remember
- Hard links cannot cross filesystems or link directories; symlinks can do both but break if the target moves.
- Tested as
- Link questions ask which survives deletion of the original or which works across mounts.
- Trap
- Assuming a symlink still works after its target file is deleted.
-
usermod -aG
Appends a user to supplementary groups; without -a, -G replaces the user's entire supplementary group list with only the groups named.
- Remember
- Group changes take effect at the user's next login or with newgrp.
- Tested as
- Access scenarios that say "without removing existing access" are testing -a.
- Trap
- Choosing usermod -G and stripping the user from wheel or sudo.
-
/etc/shadow and chage
/etc/shadow stores password hashes and ageing fields such as last change, minimum and maximum days, warning period and account expiry, and chage edits those fields.
- Remember
- chage -d 0 forces a password change at next login; chage -E sets an account expiry date; chage -l lists the policy.
- Tested as
- Expiry and forced-change scenarios name chage options.
- Trap
- Looking for password hashes in /etc/passwd, which shows only an x placeholder.
-
Signals 1, 9 and 15
SIGHUP (1) often triggers a configuration reload, SIGTERM (15) requests a clean exit and is kill's default, and SIGKILL (9) ends a process immediately and cannot be caught or ignored.
- Remember
- Escalate from 15 to 9 only if the process ignores TERM.
- Tested as
- Hung-process and reload scenarios turn on which signal fits.
- Trap
- Using kill -9 first and losing unsaved state or leaving lock files behind.
-
Zombie process
A process that has exited but whose parent has not collected its exit status, so it holds only a process table entry and shows state Z.
- Remember
- It cannot be killed; signal or restart the parent, or let init adopt and reap it when the parent ends.
- Tested as
- ps output with Z state and a question about removal.
- Trap
- Sending SIGKILL to the zombie itself.
-
nice and renice
Niceness ranges from -20 (most favourable scheduling) to 19 (least), and nice sets it at launch while renice changes it for a running process.
- Remember
- Ordinary users can only raise niceness (lower priority); lowering it requires root.
- Tested as
- A background job hogging CPU must keep running without hurting interactive users.
- Trap
- Thinking a higher nice number means higher priority.
-
cron, at and anacron
cron runs recurring jobs at exact times, at runs a job once at a set time, and anacron runs periodic jobs that were missed while the machine was off.
- Remember
- Crontab fields are minute, hour, day of month, month, day of week.
- Tested as
- Scheduling questions describe recurrence and uptime and expect the matching tool or a correct cron line.
- Trap
- Using cron for a nightly job on a machine that is usually off at that hour.
-
enable, start, mask
start runs a unit now, enable creates the links that start it at boot, and mask links it to /dev/null so it cannot be started by any means until unmasked.
- Remember
- systemctl enable --now does both start and enable.
- Tested as
- Boot persistence and "must never run" requirements test these.
- Trap
- Using disable when a dependency keeps starting the service.
-
daemon-reload and drop-ins
systemd caches unit definitions, so after a unit file changes, systemctl daemon-reload is needed before a restart uses the new settings.
- Remember
- systemctl edit unit writes an override under /etc/systemd/system/unit.d that survives package updates.
- Tested as
- "I changed ExecStart and nothing happened" scenarios.
- Trap
- Confusing systemctl reload (the service rereads its own config) with daemon-reload (systemd rereads unit files).
-
systemd timers
A .timer unit activates a matching .service on a schedule using OnCalendar or relative settings, with logging through the journal.
- Remember
- Persistent=true runs a missed calendar event at next boot, similar to anacron.
- Tested as
- Offered as the systemd-native alternative to cron.
- Trap
- Enabling the service instead of the timer, so it runs once at boot rather than on schedule.
-
Package GPG verification
Repository packages are signed, and the package manager checks the signature against an imported vendor key before installing.
- Remember
- Import the correct key (for example with rpm --import or a keyring file for apt) instead of disabling the check.
- Tested as
- Third-party repository errors and supply-chain questions.
- Trap
- Setting gpgcheck=0 to make the error go away.
-
CMD versus ENTRYPOINT
ENTRYPOINT defines the executable a container always runs, while CMD provides default arguments, or a default command when no ENTRYPOINT exists.
- Remember
- Arguments given to docker run or podman run replace CMD, not ENTRYPOINT.
- Tested as
- Dockerfile behaviour questions in the container objective.
- Trap
- Expecting run-time arguments to replace the ENTRYPOINT.
-
Container volumes and SELinux labels
Volumes and bind mounts keep data outside the container's writable layer, and on SELinux hosts the :Z (private) or :z (shared) suffix relabels host content for container access.
- Remember
- Anything written only inside the container layer is lost when the container is removed.
- Tested as
- Permission-denied and lost-data container scenarios.
- Trap
- Running --privileged or disabling SELinux to fix a label problem.
-
Container network types
bridge is the default private network with port publishing, host shares the host's network stack, none isolates the container, macvlan gives it its own MAC on the physical LAN, ipvlan shares the parent MAC, and overlay spans multiple hosts.
- Remember
- Published ports (-p host:container) apply to bridge networks.
- Tested as
- Reachability scenarios ask which network type or flag is missing.
- Trap
- Publishing ports on a host-network container and expecting remapping.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
systemctl start vs. enable vs. disable vs. mask
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| start | Runs the unit now | No effect on the next boot | Expecting the service to come back after reboot |
| enable | Creates links so the unit starts at boot | Does not start it now unless --now is added | Assuming enable also starts the service immediately |
| disable | Removes the boot-time links | The unit can still be started manually or as a dependency | Using it to guarantee a service never runs |
| mask | Links the unit to /dev/null | Blocks every start, manual or dependency, until unmasked | Forgetting to unmask before trying to start it later |
Password lock vs. account expiry vs. nologin shell
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| passwd -l / usermod -L | Prefixes the password hash with ! so password login fails | Affects password authentication only | Assuming SSH key logins are blocked too |
| chage -E 0 | Sets the account expiry date in the past | The account itself is expired for PAM-based logins | Confusing account expiry with password expiry (chage -M) |
| /sbin/nologin shell | Login shell that refuses interactive sessions | Used for service accounts that should never get a shell | Expecting it to block non-shell access such as SFTP in every configuration |
cron vs. at vs. anacron vs. systemd timer
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| cron | Recurring jobs at exact times from crontab entries | Skips runs missed while the system was off | Misordering the five time fields |
| at | One-time job at a specified time | Not recurring | Using it for a repeating task |
| anacron | Daily, weekly or monthly jobs that catch up after downtime | Day-level granularity, not exact times | Expecting minute-precise scheduling |
| systemd timer | Timer unit that activates a service | Journal logging, dependencies and Persistent= catch-up | Enabling the .service rather than the .timer |
Docker vs. Podman vs. containerd vs. runC
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Docker | Container engine with a central daemon (dockerd) | Client talks to a root-level daemon by default | Assuming every container tool needs a daemon |
| Podman | Daemonless engine with a Docker-compatible CLI | Runs rootless containers as an ordinary user | Thinking Podman cannot run Dockerfile-built images |
| containerd | Runtime daemon that manages image and container lifecycle | Sits beneath Docker and Kubernetes, not usually used directly | Treating it as a user-facing build tool |
| runC | Low-level OCI runtime that actually creates the container process | Handles namespaces and cgroups, not images or registries | Choosing it for pulling or building images |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Disable instead of mask
- What candidates pick
- systemctl disable to make sure a conflicting service never runs.
- Why it looks right
- Disable sounds like the strongest off switch.
- Why it's wrong
- A disabled unit can still be started by hand or pulled in as a dependency of another unit; only mask prevents every start.
Clue to watch for Words such as "must never start" or "keeps coming back" despite being disabled.
-
kill -9 as the first move
- What candidates pick
- SIGKILL to stop an unresponsive application.
- Why it looks right
- It always works and ends the problem quickly.
- Why it's wrong
- It denies the process any cleanup, risking corrupt files and stale locks; SIGTERM should be tried first.
Clue to watch for The scenario mentions open files, a database or a requirement to shut down gracefully.
-
Password lock equals lockout
- What candidates pick
- passwd -l to block a terminated employee immediately.
- Why it looks right
- Locking is the obvious word for removing access.
- Why it's wrong
- It only invalidates the password hash; key-based SSH or existing sessions can still work, so expiring the account and removing keys is the complete answer.
Clue to watch for The employee is known to use SSH keys or remote automation.
-
Turn off signature checks
- What candidates pick
- Set gpgcheck=0 or use --nogpgcheck to install from a new repository.
- Why it looks right
- The install succeeds immediately.
- Why it's wrong
- It removes the integrity check that protects against tampered packages; import the vendor's public key instead.
Clue to watch for An error mentioning a missing or untrusted public key.
-
Privileged container to fix access
- What candidates pick
- Run the container with --privileged when it cannot write to a bind mount.
- Why it looks right
- It removes almost every restriction, so the error disappears.
- Why it's wrong
- The usual cause on SELinux hosts is a label mismatch, fixed with :Z or :z on the mount; privileged mode exposes host devices and capabilities.
Clue to watch for SELinux is enforcing and the denial involves a host directory mounted into the container.
-
Unit change ignored
- What candidates pick
- systemctl restart again, or reboot, after editing ExecStart.
- Why it looks right
- Restarting usually picks up changes.
- Why it's wrong
- systemd still holds the old unit definition in memory until systemctl daemon-reload runs.
Clue to watch for systemctl status warns that the unit file changed on disk.
Answer framework
For a services or user-management scenario, match the requirement's scope and timing before choosing the command.
- Name the object being managed: a file, an account, a process, a package, a systemd unit or a container.
- Decide whether the requirement is immediate, persistent across reboot, or both, and whether existing settings must be preserved.
- Pick the command and the exact option that meets it, such as -aG to append groups or enable --now for start plus boot.
- Prefer the least disruptive action first: reload before restart, SIGTERM before SIGKILL, a drop-in override before editing vendor files.
- Reject answers that solve the symptom by removing a safeguard, such as skipping GPG checks, disabling SELinux or running privileged containers.
Practice question
Want more like this? The CompTIA Linux+ practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin with accounts and files, since they are compact and the exact options are easy to drill: create users with useradd -m, change groups with usermod -aG, expire accounts with chage, and make hard and symbolic links, then delete targets to see which survives. Next, spend real time on systemd, the objective most likely to show up in other domains: write a small service and a timer, break the unit file, use daemon-reload, mask a unit and read systemctl status and journalctl output.
Then work through processes and scheduling: send each of the three named signals to a test process, renice a CPU hog, create a zombie with a short script if you can, and write crontab entries until the field order is automatic.
The commonly underestimated areas are package management details (GPG keys, exclusions, update-alternatives) and containers. Build an image from a Dockerfile, run it with Podman as an ordinary user, attach a volume on an SELinux-enforcing host and publish a port.
Afterwards, practise mixed scenario questions and, for every miss, write down which single option or flag made the difference.
FAQ
How much is Services and User Management worth on XK0-006?
It is 20% of the exam with six official objectives. Against the 90-question maximum that is roughly 18 items, which is an editorial planning estimate rather than an official figure.
Do I need to know both Docker and Podman?
The objective names runC, Podman, containerd and Docker as runtimes. Their image and container commands are largely interchangeable, so focus on the shared concepts and on what makes Podman different: no central daemon and rootless operation.
What is the difference between systemctl reload and daemon-reload?
systemctl reload service tells the running service to reread its own configuration, such as an Nginx config file. systemctl daemon-reload makes systemd reread unit files after you edit them.
Which signals do I need to memorise?
The objectives list 1 (HUP), 9 (KILL) and 15 (TERM). Know that TERM is kill's default and allows cleanup, KILL cannot be caught, and HUP is commonly used to make daemons reload.
Which common services must I be able to configure?
The objective lists basic configuration of DNS, NTP/PTP, DHCP, HTTP (Apache httpd and Nginx), SMTP and IMAP4. Expect questions on which service fills which role and where its configuration lives, rather than deep tuning.
How do I stop a package from being upgraded?
On dnf-based systems add an exclude entry to the configuration or repository file; on apt-based systems use apt-mark hold. Both keep the current version while the rest of the system updates.
How does this domain connect to Security?
Domain 3 hardens the accounts, sudo rights, services and containers you manage here, adding SELinux, ACLs, PAM and firewall rules. Knowing the normal behaviour of systemctl, usermod and container volumes makes the security scenarios much easier to read.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 2 knowledge
You have covered links and file searches, account lifecycle, signals and scheduling, packages and repositories, systemd units and containers. Test whether you can spot the one option that meets each requirement exactly.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CompTIA Linux+ AI tutor Get any concept explained your way