Overview
System Management is the largest XK0-006 domain at 23%, with seven objectives that describe the day-to-day work of running a Linux server: the boot chain from bootloader to kernel to initrd, the Filesystem Hierarchy Standard (FHS), kernel modules and hardware inspection, the full Logical Volume Manager (LVM) stack with partitions, filesystems, RAID and mount options, network configuration through NetworkManager, Netplan and the classic resolver files, shell redirection and text utilities, archiving and backup tools, and KVM/QEMU virtualization.
The domain exists because CompTIA expects a candidate with about 12 months of hands-on server experience to build and maintain a system, not just describe one. It is the vocabulary for the rest of the exam: Domain 2 manages services on top of this foundation, Domain 3 hardens it, Domain 4 automates it, and Domain 5 asks you to fix it when these same components fail.
How it's tested
System Management items are mostly scenario and command-selection questions: a server state is described and you choose the command, option or file that achieves the goal. PBQs may ask you to order the LVM steps, fill in an /etc/fstab line or pick the right network tool. The winning habit is to identify the layer involved first, then the tool that works on that layer.
-
Pick the tool for the layer
A storage or network task is described and the options mix tools from different layers, such as partition, physical volume, logical volume and filesystem. Only one acts on the layer the scenario names.
-
Order the procedure
You sequence steps such as pvcreate, vgextend, lvextend and filesystem growth, or archive, compress and transfer. The trap is a step that is valid but out of order.
-
Read the output
A snippet of lsblk, df -i, /proc/mdstat, ip addr or ss output is shown, and you infer the state, such as a degraded mirror or a full inode table.
A scenario says df -h shows /var at 40% used, yet applications report "No space left on device" when creating small cache files. Free blocks are clearly available, so the limit must be something else on the same filesystem. Running df -i reveals 100% inode use from millions of tiny files. The fix is to clean up those files, or recreate the filesystem with more inodes, rather than treat it as a data-capacity problem.
Objectives 7
Official objectives from the CompTIA outline, in outline order.
1.1 Explain basic Linux concepts.Boot process, FHS directories, architectures, distribution families, GUI stack and licensing.
- What it means
- This objective covers the boot chain (firmware, bootloader and its configuration, kernel parameters, initial RAM disk, PXE network boot), where things live under the FHS, server CPU architectures (x86_64/AMD64, AArch64, RISC-V), RPM-based versus dpkg-based families, the X Server versus Wayland display stack, and software licence types.
- What to understand
- Know what each directory holds: /etc for configuration, /var for changing data such as logs and spools, /boot for the kernel and initramfs, /proc as a virtual view of kernel and process state. Know that copyleft licences (such as the GPL) require derivative works to stay under the same terms, while permissive open source licences do not.
- How it shows up
- A question gives a kernel parameter to add permanently, a file to locate, or a distribution's package format and asks which directory, family or boot stage applies.
- Common confusion
- Candidates treat "free software" as meaning zero cost; it refers to user freedoms, and free software can be sold. They also confuse the bootloader (GRUB2) with the initrd, which is the temporary root filesystem the kernel loads to reach the real root.
1.2 Summarize Linux device management concepts and tools.Kernel modules, hardware inspection tools and initrd rebuilds.
- What it means
- Covers loading and removing kernel modules (lsmod, modinfo, modprobe, insmod, rmmod, depmod), inspecting hardware (lspci, lsusb, lscpu, lsmem, lshw, dmidecode, dmesg, lm_sensors, ipmitool), and rebuilding the initial RAM disk with dracut or mkinitrd.
- What to understand
- modprobe reads the dependency map that depmod builds and loads required modules first; insmod loads a single file and fails if dependencies are missing. dmidecode reads firmware (DMI/SMBIOS) tables for serial numbers and memory slots, while ipmitool talks to the baseboard management controller out of band. After adding a storage driver needed at boot, the initramfs must be regenerated.
- How it shows up
- A new network card is not detected, or a driver needs a parameter; you choose the command that shows the device (lspci -k) or loads the module with its dependencies (modprobe).
- Common confusion
- Picking insmod because it sounds like "install module". It does not resolve dependencies, so modprobe is the expected answer for everyday loading.
1.3 Given a scenario, manage storage in a Linux system.LVM, partitions, filesystems, RAID, mounts, mount options and inodes.
- What it means
- This is the storage stack end to end: partitioning (fdisk, gdisk, parted, growpart), LVM physical volumes, volume groups and logical volumes, filesystems (ext4, XFS, Btrfs, tmpfs) and their tools (mkfs, fsck, resize2fs, xfs_growfs, xfs_repair), software RAID with mdadm, and persistent mounts in /etc/fstab including NFS and SMB shares and autofs.
- What to understand
- Growth flows bottom up: partition or disk, then pvcreate, vgextend, lvextend, then the filesystem (lvextend -r does the last step for you). XFS can grow but cannot shrink; ext4 can shrink, but only unmounted. Mount options matter: nofail lets boot continue if a device is missing, noexec and nosuid block binaries and setuid on a mount.
- How it shows up
- A scenario asks you to add capacity, make a mount survive reboot, identify a degraded array from /proc/mdstat, or choose options that harden a removable or shared mount.
- Common confusion
- Running resize2fs on an XFS volume, or extending the logical volume and forgetting the filesystem, so df still shows the old size.
1.4 Given a scenario, manage network services and configurations on a Linux server.Resolver files, NetworkManager, Netplan and network diagnostic tools.
- What it means
- Covers name resolution files (/etc/hosts, /etc/resolv.conf, /etc/nsswitch.conf), interface configuration with nmcli or Netplan YAML in /etc/netplan, and the diagnostic toolbox: ip address/link/route, ss, ping, traceroute, tracepath, mtr, dig, nslookup, ethtool, tcpdump, nmap, nc, iperf3, curl and arp.
- What to understand
- nsswitch.conf sets lookup order, so "hosts: files dns" means /etc/hosts wins over DNS. On NetworkManager systems, edits made directly to resolv.conf are often overwritten; change the connection profile instead. netplan try applies a change and rolls it back automatically unless you confirm, which protects remote sessions.
- How it shows up
- You pick the right tool for a symptom: ss -tulpn for what is listening, dig for DNS answers, ethtool for link speed and duplex, iperf3 for throughput, mtr for per-hop loss over time.
- Common confusion
- Using ping to prove a service works. ping tests ICMP reachability only; a web service needs curl or nc against the actual port.
1.5 Given a scenario, manage a Linux system using common shell operations.Environment variables, paths, shell startup files, redirection, text utilities and editors.
- What it means
- Covers variables such as PATH, HOME, PS1 and DISPLAY, absolute versus relative paths, the startup files .bash_profile, .profile and .bashrc, redirection and pipes (>, >>, <, 2>, <<, <<<, |, tee), the text toolkit (grep, sed, awk, cut, sort, uniq, tr, wc, xargs, head, tail) and vi/vim or nano.
- What to understand
- Login shells read .bash_profile (or .profile); interactive non-login shells read .bashrc. Redirection is processed left to right, so cmd > out.log 2>&1 captures both streams, while cmd 2>&1 > out.log still prints errors to the terminal. A variable only reaches child processes after export.
- How it shows up
- A one-liner is shown and you predict its output, or you choose the pipeline that counts unique IP addresses in a log (cut or awk, then sort, then uniq -c).
- Common confusion
- Running uniq on unsorted input. uniq only collapses adjacent duplicates, so sort must come first.
1.6 Given a scenario, perform backup and restore operations for a Linux server.Archiving, compression and copy tools for backup and recovery.
- What it means
- Covers archiving with tar and cpio, compression with gzip, bzip2, xz, 7-Zip and unzip, reading compressed files in place with zcat, zgrep and zless, and copy tools: rsync for incremental file sync, dd for block-level images and ddrescue for failing disks.
- What to understand
- tar bundles files and keeps ownership and permissions; the compression flag picks the algorithm (z gzip, j bzip2, J xz), trading speed for size. rsync copies only changes and can mirror deletions with --delete. dd copies raw blocks, including empty space and partition tables; ddrescue skips bad areas first and retries later, which suits a dying drive.
- How it shows up
- A scenario names a need, such as a nightly offsite sync, a full disk clone or recovering data from a disk throwing read errors, and you select the matching tool and options.
- Common confusion
- Treating compression as a backup. gzip on its own replaces a single file; it does not bundle a directory tree, which is tar's job.
1.7 Summarize virtualization on Linux systems.KVM and QEMU, VirtIO, disk images, VM operations, network modes and libvirt tools.
- What it means
- Covers the KVM kernel module with QEMU as the device emulator, paravirtualized VirtIO drivers, disk image operations (convert, resize, inspect), VM states, nested virtualization, templates, cloning, migration and snapshots, network modes (bridged, NAT, host-only/isolated, routed, open) and the libvirt toolset (virsh, virt-manager).
- What to understand
- VirtIO drivers let the guest talk to the hypervisor directly instead of through emulated hardware, which improves disk and network performance. Bridged guests appear on the physical LAN with their own addresses; NAT guests share the host's address and are not reachable inbound without forwarding; host-only guests talk only to the host and each other. Snapshots preserve a point in time on the same storage and do not replace backups.
- How it shows up
- You choose a network mode for a stated reachability need, or the virsh action for a task, such as virsh shutdown for a clean stop versus virsh destroy for a forced power-off.
- Common confusion
- Assuming virsh destroy deletes the VM. It only forces it off; virsh undefine removes the definition.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
LVM growth order
Capacity is added at the disk, then pvcreate, vgextend, lvextend, and finally the filesystem is grown to fill the new logical volume space.
- Remember
- lvextend -r (or --resizefs) grows the filesystem in the same step, using resize2fs for ext4 or xfs_growfs for XFS.
- Tested as
- Storage PBQs and ordering questions test this exact sequence and expect you to notice a skipped filesystem step.
- Trap
- Stopping after lvextend and wondering why df still reports the old size.
-
XFS versus ext4 resizing
XFS can be grown online with xfs_growfs against the mount point but cannot be shrunk at all, while ext4 can grow online and shrink only when unmounted with resize2fs.
- Remember
- A requirement to shrink a volume rules out XFS; the answer is backup, recreate and restore.
- Tested as
- Appears when a scenario asks to reclaim space from one volume to give to another.
- Trap
- Choosing resize2fs or lvreduce on an XFS filesystem.
-
Inode exhaustion
Every file consumes an inode, and ext4 sets its inode count (bytes-per-inode ratio) when the filesystem is created, so millions of tiny files can exhaust inodes while blocks remain free.
- Remember
- df -i shows inode use; df -h shows only block use.
- Tested as
- A "No space left on device" error alongside free space in df -h points directly here.
- Trap
- Buying more disk instead of removing the small files that consumed the inodes.
-
/etc/fstab fields and nofail
Each fstab line lists the device (ideally by UUID), mount point, filesystem type, options, dump flag and fsck pass order, and is read at boot and by mount -a.
- Remember
- Use UUID= because /dev/sdX names can change; add nofail for devices that might be absent so boot does not halt.
- Tested as
- Persistent-mount scenarios and boot failures caused by a missing disk both hinge on these fields.
- Trap
- Testing a new line by rebooting instead of running mount -a first to catch syntax errors.
-
Mount hardening options
noexec blocks running binaries from the mount, nosuid ignores setuid and setgid bits, and nodev ignores device files, which together limit what an attacker can do from writable or removable media.
- Remember
- These are commonly applied to /tmp, removable media and shared mounts.
- Tested as
- Asked as the best way to stop users running uploaded programs from a shared directory.
- Trap
- Choosing ro when the requirement still needs users to write files.
-
/proc/mdstat
Shows the state of every software RAID array managed by mdadm, with a status string such as [UU] for a healthy two-disk mirror and [U_] when one member has failed.
- Remember
- An underscore marks a missing or failed device; mdadm --detail gives the full picture.
- Tested as
- Output-reading items show this file and ask whether the array is degraded.
- Trap
- Reading [U_] as healthy because the array is still mounted and serving data.
-
modprobe versus insmod
modprobe loads a module by name and pulls in its dependencies using the map built by depmod, while insmod loads one module file path with no dependency handling.
- Remember
- Use modprobe to load and modprobe -r to unload; persist options in /etc/modprobe.d.
- Tested as
- Driver scenarios expect modprobe as the standard tool.
- Trap
- Selecting insmod because its name suggests installation.
-
Name resolution order
/etc/nsswitch.conf tells the resolver which sources to consult and in what order, typically files before dns, so an /etc/hosts entry overrides a DNS answer.
- Remember
- dig and nslookup query DNS directly and bypass /etc/hosts; getent hosts follows nsswitch.
- Tested as
- Explains why a host resolves differently for an application than for dig.
- Trap
- Concluding DNS is wrong when a stale /etc/hosts entry is the cause.
-
Redirection order
The shell applies redirections left to right, so 2>&1 duplicates standard error onto wherever standard output points at that moment.
- Remember
- cmd > file 2>&1 sends both streams to the file; cmd &> file is the bash shorthand.
- Tested as
- Prediction questions show a command and ask where errors end up.
- Trap
- Writing 2>&1 before > file and expecting errors in the file.
-
netplan try
Applies a new Netplan configuration and automatically reverts it after a timeout unless the administrator confirms, protecting a remote session from a bad change.
- Remember
- netplan apply makes the change without any rollback safety net.
- Tested as
- Remote-change scenarios on Ubuntu-style servers favour try over apply.
- Trap
- Choosing netplan apply for a risky change over SSH.
-
rsync versus dd
rsync works at file level and transfers only differences, which suits recurring backups, while dd copies raw blocks of a device or image regardless of what the blocks contain.
- Remember
- rsync -a preserves permissions, times and links; dd clones partitions and boot sectors.
- Tested as
- Backup scenarios specify incremental, bandwidth-efficient copies or exact disk clones.
- Trap
- Using dd for a nightly sync of a changing directory.
-
VirtIO
A paravirtualized driver framework where the guest knows it is virtualized and uses efficient virtual devices instead of emulated legacy hardware.
- Remember
- VirtIO disk and network drivers are the usual fix for slow guest I/O on KVM.
- Tested as
- Performance questions about KVM guests point to switching to VirtIO devices.
- Trap
- Adding vCPUs or RAM when the bottleneck is emulated storage.
-
dracut
Builds the initramfs that the kernel loads before the real root filesystem, including the drivers needed to reach root storage.
- Remember
- Rebuild it after adding a storage driver or changing how root is accessed, or the system may fail to boot.
- Tested as
- Driver and boot scenarios ask what to run after adding modules required at boot.
- Trap
- Updating only the GRUB configuration when the missing piece is in the initramfs.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
ext4 vs. XFS vs. Btrfs vs. tmpfs
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| ext4 | Journaling filesystem with a fixed inode count set at creation | Grows online, shrinks offline with resize2fs; repaired with fsck/e2fsck | Forgetting that small-file workloads can exhaust inodes |
| XFS | High-performance journaling filesystem, default on RHEL-family systems | Grows online with xfs_growfs but cannot shrink; repaired with xfs_repair | Running resize2fs or fsck.ext4 against it |
| Btrfs | Copy-on-write filesystem with subvolumes, snapshots and checksums | Built-in snapshots and multi-device support without LVM | Treating its snapshots as offsite backups |
| tmpfs | Filesystem held in memory (and swap) | Contents vanish at reboot | Storing data on it that must persist |
Partition vs. physical volume vs. volume group vs. logical volume
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Partition | Slice of a disk defined in the partition table | Managed with fdisk, gdisk, parted or growpart | Thinking growpart alone enlarges the filesystem |
| Physical volume (PV) | Disk or partition initialised for LVM with pvcreate | The raw building block LVM consumes | Skipping pvcreate before vgextend |
| Volume group (VG) | Pool of space made from one or more PVs | vgextend adds PVs; vgs shows free extents | Trying to lvextend when the VG has no free space |
| Logical volume (LV) | Allocated slice of a VG that holds a filesystem | Resized with lvextend or lvresize | Not growing the filesystem afterwards |
VM network modes: bridged vs. NAT vs. host-only
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Bridged | Guest connects to the physical network through a host bridge | Guest gets its own LAN address and is reachable inbound | Choosing NAT for a server other hosts must reach |
| NAT | Guest traffic is translated to the host's address | Outbound works; inbound needs port forwarding | Expecting LAN clients to connect to the guest directly |
| Host-only / isolated | Private network between host and guests | No route to the outside network | Using it when the guest needs updates from the internet |
tar vs. rsync vs. dd vs. ddrescue
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| tar | Bundles a file tree into one archive, optionally compressed | Preserves ownership and permissions inside the archive | Mixing up -c (create) and -x (extract) |
| rsync | Synchronises files locally or over SSH | Sends only changed data; --delete mirrors removals | Forgetting that a trailing slash on the source changes what is copied |
| dd | Copies raw blocks between devices or files | Captures partition tables and boot sectors | Reversing if= and of= and overwriting the source |
| ddrescue | Block copier designed for failing media | Copies good areas first and logs bad ones for retry | Using plain dd on a disk with read errors |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Growing the wrong layer
- What candidates pick
- growpart or lvextend alone to fix a full filesystem.
- Why it looks right
- Both commands genuinely add space and appear in the objectives.
- Why it's wrong
- Space added below the filesystem is invisible to applications until the filesystem itself is grown with xfs_growfs, resize2fs or lvextend -r.
Clue to watch for The scenario says the command succeeded but df still shows the old size.
-
Blocks versus inodes
- What candidates pick
- Add disk space when df -h shows plenty free.
- Why it looks right
- "No space left on device" sounds like a capacity problem.
- Why it's wrong
- When free blocks remain, the shortage is inodes; the real fix is removing the runaway small files (or recreating the filesystem with more inodes), not adding capacity.
Clue to watch for Many small files, such as session or cache files, plus free space in df -h.
-
Editing resolv.conf on a managed system
- What candidates pick
- Edit /etc/resolv.conf directly to change DNS servers permanently.
- Why it looks right
- It is the file the resolver reads.
- Why it's wrong
- NetworkManager, systemd-resolved or Netplan regenerate it, so the change is lost; the persistent fix belongs in the connection profile or Netplan YAML.
Clue to watch for The scenario says the DNS change "keeps reverting" after a reboot or reconnect.
-
ping proves the service
- What candidates pick
- ping the server to confirm a web application is reachable.
- Why it looks right
- ping is the first tool everyone learns.
- Why it's wrong
- ICMP reachability says nothing about a TCP port; a firewall can allow ping and block 443, or the reverse.
Clue to watch for The question names a specific port or application protocol.
-
Snapshot as backup
- What candidates pick
- Rely on VM or Btrfs snapshots as the backup strategy.
- Why it looks right
- Snapshots restore quickly and are easy to take.
- Why it's wrong
- Snapshots share the same underlying storage, so a failed disk or deleted pool loses both; a backup must be a separate copy.
Clue to watch for Requirements mention disk failure, offsite storage or retention.
-
dd on a failing disk
- What candidates pick
- dd to image a drive that is throwing read errors.
- Why it looks right
- dd is the familiar block-copy tool.
- Why it's wrong
- dd stalls or aborts on bad sectors by default and stresses the drive; ddrescue copies the readable data first and retries bad areas later.
Clue to watch for dmesg shows I/O errors or the disk is described as failing.
Answer framework
For a System Management scenario, locate the layer first and the command follows.
- Identify the layer the task touches: firmware and boot, kernel module, disk or partition, LVM, filesystem, mount, network profile, shell, or hypervisor.
- Read the given evidence, such as df, lsblk, /proc/mdstat or ip output, and state the current condition in one sentence.
- Choose the tool built for that layer and that filesystem or distribution family, for example xfs_growfs for XFS or nmcli on NetworkManager systems.
- Check whether the change must persist, then put it in the persistent place: /etc/fstab, a connection profile, Netplan YAML, /etc/modprobe.d or a rebuilt initramfs.
- Prefer the option that verifies safely before committing, such as mount -a, netplan try, or a backup before resizing.
Practice question
Want more like this? The CompTIA Linux+ practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with storage, because it is the deepest objective and it feeds directly into Domain 5 troubleshooting. Build a lab VM with two spare virtual disks and practise the whole cycle: partition, pvcreate, vgcreate, lvcreate, mkfs, mount, add to /etc/fstab by UUID, then extend with lvextend -r on both ext4 and XFS. Break things on purpose: fill a filesystem with tiny files to see inode exhaustion, fail an mdadm mirror member and read /proc/mdstat.
Next, work through networking with both NetworkManager (nmcli) and Netplan, since the exam names both, and pair each diagnostic tool with the question it answers. Then drill shell operations: redirection order, startup-file behaviour and text pipelines are easy points once practised and costly when guessed.
Commonly underestimated areas are kernel modules and initramfs rebuilds, the meaning of each mount option, and virtualization vocabulary such as VirtIO and network modes. Finish with backup tools, comparing tar, rsync, dd and ddrescue on the same data.
Afterwards, take timed practice sets that mix command-selection questions with output-reading items, and review every miss by naming the layer you misjudged.
FAQ
How much of the Linux+ XK0-006 exam is System Management?
System Management is 23% of the exam, the largest of the five domains, with seven official objectives. With a maximum of 90 questions, that suggests about 21 items as a planning estimate, not an official count.
Which System Management topic should I study most?
Storage (objective 1.3) has the most named tools, covering LVM, partitions, filesystems, RAID and mounts, and it reappears in Domain 5 troubleshooting. Expect to sequence or select storage commands under time pressure.
Do I need to know both NetworkManager and Netplan?
Yes. The objectives list nmcli and Netplan commands (apply, status, try) as well as the resolver files, so be ready to configure an interface either way and to know which file or profile holds the persistent setting.
Are there performance-based questions in this domain?
CompTIA states the exam includes performance-based questions but does not say which domains they cover. Command-driven objectives such as storage, networking and shell operations lend themselves to that format, so practise them hands-on.
What is the difference between .bashrc and .bash_profile?
.bash_profile (or .profile) runs for login shells, such as an SSH login, while .bashrc runs for interactive non-login shells, such as a new terminal window. Many distributions source .bashrc from .bash_profile so settings apply in both.
How deep does the virtualization objective go?
It is a "summarize" objective, so focus on concepts and tool roles: KVM with QEMU, VirtIO, disk image operations, snapshots, cloning, migration, network modes and the libvirt tools virsh and virt-manager. Container management is a separate objective in Domain 2.
How does System Management connect to Troubleshooting?
Domain 5 describes failures such as a filesystem that will not mount, a full disk, inode exhaustion or a GRUB misconfiguration. Fixing them uses the tools you learn here, so this domain is the toolkit and Domain 5 is where it is tested under symptoms.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 1 knowledge
You have worked through the boot chain, the LVM and filesystem stack, network configuration, shell redirection, backups and KVM virtualization. Check that you can pick the right command for each layer under timed conditions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CompTIA Linux+ AI tutor Get any concept explained your way