XK0-006 deep review — September 29, 2026

Same-context AI review; independent human review pending. Study guide. Native Linux runtime execution remains blocked and deferred; public-source content review and the narrower local checks are complete.

Scope, lifecycle and accepted metadata

The official Linux+ page retains V8/XK0-006, July 15, 2025 launch, weights 23/20/18/17/22, maximum 90 questions, 90 minutes, score 720/900 and English. Retirement remains estimated 2028 with no exact date. Recommended experience is not a mandatory certification prerequisite.

Read every numbered objective and detailed bullet in the public document 5.0 PDF: 20 pages, 29 objectives in groups of 7/6/6/5/5. Page 11 layout confirms 3.1 authentication/accounting, 3.2 firewalls and 3.3 OS hardening; plain extraction orders the trailing numbers differently. Original paraphrases with published IDs are mapped in the receipt. The main page also has 29 summary rows, with less detail; the PDF is not redistributed.

The only normalized monitor addition is Duration: 90 minutes, already taught. No topic, weight or retirement text changed. Explicit acceptance retains the byte-identical prior snapshot and historical review/audit hashes, dates and conclusions, with prior status and before/after evidence recorded. PDF version 5.0 is distinct from exam V8.

Teaching corrections and implementation boundaries

The Linux umask interface clears requested bits rather than subtracting an octal number: 0666 with mask 0003 becomes 0664. Default ACLs alter creation inheritance, still bounded by the requested mode. ACL documentation supports named-entry/group-class mask and mode correspondence. Added qualified directory deletion, setgid/sticky and path/MAC distinctions; these arithmetic examples are not native enforcement tests.

The outline contains older or inconsistent command labels. Upstream NetworkManager documents nmcli/nmtui and nmtui-connect; virt-manager is the upstream VM management tool; systemd documents systemd-analyze blame, with important parallel-start/dependency limits. The PDF’s here-document grouping of <<< is clarified using Bash’s here-string distinction. Objective 3.4 still names pam_tally2, but Linux-PAM release notes removed it in 1.5.0. The current faillock module requires different stack configuration, not a blind name replacement. No authentication policy changed.

Added explicit OpenTofu, cloud-init/Kickstart, Kubernetes/Swarm/Compose roles from objective 4.1, systemd state/timer boundaries, software/service configuration evidence, 5.1 monitoring and SLI/SLO/SLA cases. Upstream latest systemd docs identify version 262; the guide does not assume this is installed on a learner’s distribution. A persistent calendar timer does not replay every missed interval, and an already active target is not restarted merely by a timer firing.

rsync source slash and archive-mode exclusions are explained; no transfer was executed. Red Hat’s backporting article supports checking exact vendor package/advisory evidence rather than upstream version alone. Its old examples do not establish current release support. Current sanitization guidance qualifies destructive tools and file-overwrite limits. No device, live media or existing user data was erased.

Actual local execution and deferred blocker

Both original public examples and a harness passed 44 checks: Windows Python 3.13.14, Git for Windows MSYS Bash 5.3.15, GNU tar 1.35 and Findutils 4.11.0. The Bash script safely displays six synthetic filenames and propagates an injected failed producer. Checks cover spaces, a leading hyphen, quotes, newline/glob names as mapped by MSYS, empty/binary data, invalid roots, empty traversal, pipeline status/subshell behavior and redirection. The MSYS filename mapping is not native Linux filesystem proof.

GNU tar actually archived and restored the owned fixture. The Python comparator verified directory structure and file hashes, then detected changed, missing and extra entries and returned the appropriate CLI status. The source stayed unchanged and the owned temporary tree was cleaned. The comparator assumes static owned trees; it is not a race-resistant path sandbox. Symlink/junction enforcement was not tested, and Linux ownership, ACLs, xattrs, timestamps, sparse allocation, hard-link identity and application-consistent backup were not established.

Permission/ACL models, 4 MiB extent arithmetic and synthetic SLI/time-budget calculations also passed. The earlier WSL/Linux runtime startup blocker remains deferred; no native systemd/PAM, Linux account/firewall/network, block device, VM/container, cloud resource or reboot test ran. All eight full distribution labs remain proposed with explicit success/negative-case evidence. The review is recorded as reviewed-with-blockers rather than claiming native Linux lab completion.

Catalog and source limits

Current public metadata: Pluralsight 5 courses/4 labs/27 hours, courses March–April 2025 and labs April–August 2026; LinkedIn Total Seminars 15h42, 10 quizzes, released March 18, 2026. MeasureUp CertKit lists course content, exam simulation and Online Mentor, with 365-day e-learning and 60-day practice access beginning at first practice access. Recheck terms; no bank size was invented. CompTIA Perform/Learn/Practice/Labs estimates overlap. Extra study-hour ranges are planning suggestions.

O’Reilly and Udemy blocked automated rechecking, so the earlier sixth-edition and 34h39 claims are qualified. No paid interiors, assessment questions or provider labs were accessed. Places to learn is final. No dedicated blog was needed; primary project documentation and the vendor’s explanatory backporting article supplied the adopted teaching. Targeted reading is not a complete audit of every long manual.

The Findutils HTML/manual retrieval routes failed initially and PDF retrieval was intermittent. The indexed official safe-filename section and installed tool help independently supported NUL handling; generic PDF bytes decoded as HTML were not treated as meaningful documentation text. The final retrieval receipt records the available representation separately.

Repository validation, 176 unit tests, strict site build, generated-site validation, learning catalog consistency and diff checks are recorded after execution in the operational receipt.