TL;DR: A+ tests Linux as administration (files, permissions, processes, packages). PenTest+ tests Linux as a weapon platform (recon, scanning, capture, cracking, all scoped and authorized). Learn each command with its exam job and its one dangerous flag. Practice in the app's terminal labs before exam day.
How the two exams split Linux
A+ Core 2 expects you to operate a Linux workstation: move around, manage files and users, fix boot and network issues, install software. PenTest+ expects you to run an engagement from a Linux attack host: footprint targets, scan ports, capture traffic, crack hashes you are authorized to test, and document everything. Same shell, different intent. This sheet covers both, marked [A+] or [PT+] per command where the emphasis differs.
Moving around and reading files [A+]
- pwd prints where you are. First command in any unfamiliar shell, and the answer to "which command shows the current directory."
- ls -la lists files including hidden ones with permissions. The -l long format is where permission questions start: read the leftmost column as user/group/other triples.
- cd changes directory. Know absolute vs relative paths: /etc starts at root, ../ steps up one level.
- cat dumps a whole file. Fine for short config files, painful for long logs.
- less pages through long files with search. The exam pairs it with log reading: less plus /search-term beats cat for anything over a screen.
- head -n 20 / tail -n 20 show the start or end of files. tail -f follows a growing log live, which is how you watch authentication failures arrive during brute-force scenarios.
- find / -name shadow searches by name across the tree. The exam contrasts find (searches the filesystem) with grep (searches inside files) and locate (searches a prebuilt index, faster but possibly stale).
- grep -ri failed /var/log/auth.log searches file contents, case-insensitive and recursive with those flags. Pipe anything into grep to filter: ps aux | grep ssh narrows process lists to what matters.
Files, owners, permissions [A+]
- touch, mkdir -p, cp -r, mv, rm -ri create, copy, move, and remove. The -i flag prompts before each removal and is the exam's approved safe habit; rm -rf with no backup is how scenarios describe data loss.
- chmod 640 file sets permissions by octal: owner read/write (6), group read (4), other nothing (0). Memorize the common set: 777 (everything, almost never correct), 755 (executable scripts and public directories), 644 (normal files), 600 (private keys and secrets).
- chmod u+x script.sh adds execute for the owner symbolically. Symbolic mode (u/g/o with +/-) answers "change one class without touching the rest" questions.
- chown user:group file changes ownership. Only root can give files away, which the exam tests as a privilege question, not a syntax question.
- sudo command runs one command as root. Know the principle behind it: least privilege means admin rights per command, not a permanent root login.
- df -h / du -sh dir report disk free space and directory usage. "Disk full" scenarios start here, not with new hardware.
- mount / umount / lsblk attach, detach, and list block devices. A+ loves the missing-mount scenario: the drive is healthy, the data is fine, it is simply not mounted where the user looks.
- tar -czvf backup.tar.gz dir archives and compresses. Know create (c), extract (x), list (t) as the three verbs; the exam asks which verb restores from an archive.
Users, processes, services [A+]
- useradd / passwd / usermod -aG sudo user create accounts, set passwords, grant group membership. The -a in usermod appends; without it you replace the user's groups, which is a classic exam trap.
- ps aux / top / htop list processes with static, live, and friendly views. Add kill by PID next: read the process, then act on it.
- kill PID / kill -9 PID / pkill -f name stop processes gently, forcefully, or by pattern. The exam order matters: try plain kill first, escalate to -9, because forced kills skip cleanup.
- systemctl status/start/enable service controls services on modern distros. Distinguish start (now) from enable (at boot): the service that works until reboot was started but never enabled.
- journalctl -u service -f reads that service's logs live. Pairs with systemctl the way tail pairs with files.
- crontab -e schedules recurring jobs. Syntax questions use the five-field order (minute, hour, day-of-month, month, day-of-week); a backup that runs hourly instead of daily has its fields shifted.
- uname -a / uptime / free -h report kernel, load, and memory. First-response commands when handed an unknown slow machine.
Networking from the shell [A+, PT+]
- ip addr / ip route show addresses and the routing table. The modern replacement for ifconfig and route, and the exam now phrases questions with ip subcommands.
- ping -c 4 host tests reachability. Unanswered pings prove little alone (firewalls drop ICMP); the exam wants ping followed by something stronger.
- ss -tulpn lists listening ports with processes. This is the "what is running on this box" command and the fastest way to confirm an unexpected service.
- curl -I https://host / wget url fetch over HTTP for testing and download. curl doubles as a quick TLS and header check during web recon.
- dig host / nslookup host query DNS. dig with +short gives clean answers; both appear in PenTest+ recon alongside whois for ownership and registration data.
- traceroute / tracepath host maps the path packets take. Useful for "where does it stop" troubleshooting and for footprinting network depth.
- ssh user@host / scp file user@host:/path connect and copy securely over port 22. The exam contrasts scp/sftp (encrypted, over SSH) with FTP/TFTP (cleartext or unauthenticated); see the port cheat sheet for the numbers behind that contrast.
Packages and updates [A+]
- apt update then apt upgrade refreshes package lists, then installs updates. Running upgrade without update is the exam's stale-cache trap.
- apt install / apt remove add and remove software with dependency handling. Know that remove can leave config files behind (purge clears them).
- dnf / yum do the same job on Red Hat family systems. The exam tests recognizing the family from the tool, not memorizing every flag.
The PenTest+ recon and attack set [PT+]
Every tool here assumes written authorization and a defined scope. The PenTest+ exam punishes out-of-scope testing harder than it rewards tool trivia, so read our study plan coverage of scope alongside this list.
- nmap -sV -O target scans ports with version detection and OS guessing. The exam reads Nmap output tables fluently: open vs filtered, service strings, OS guesses. Add -sS for stealth SYN scans and --top-ports for fast triage.
- netcat (nc -lvnp port) opens listeners and probes connections. The Swiss-army listener for banner grabbing and shell handling in labs.
- theHarvester -d domain -b sources gathers emails, names, and hosts from public sources. It harvests people and addresses, not subdomains; that distinction is tested.
- dig / whois / nslookup answer ownership and records during footprinting. WHOIS gives the registrar story, dig gives the DNS truth.
- Wireshark / tcpdump capture and dissect traffic. Know capture filters (limit what is recorded) vs display filters (limit what is shown); the exam asks which to use when disk or time is short.
- John the Ripper / hashcat crack password hashes where authorized. The exam contrasts wordlist attacks (fast, bounded) with brute force (slow, complete) and asks which fits a time-boxed test.
- Hydra tests logins against services. Its exam job is online password guessing, paired with lockout and alerting questions on the defense side.
- Burp Suite proxies and probes web apps. Repeater and Intruder answer "manipulate this request" scenarios.
- BloodHound maps Active Directory attack paths. Its exam job is identity-graph reasoning: shortest path to domain admin, not individual exploits.
Scripting sight-reading [PT+, A+]
Both exams show short scripts and ask what they do. Read for verbs, not fluency: a for loop over a wordlist with curl calls is a brute-forcer; chmod 777 in a setup script is the vulnerability; rm -rf with a variable that could be empty is the disaster. The PBQ strategy guide covers terminal sims where this skill pays directly.
Sources
By SecLern Editorial. Published October 18, 2026. Updated October 18, 2026. Tool coverage cross-checked against the SecLern PenTest+ question bank (packs/comptia-pentest-pt0-003), including Nmap, theHarvester, dig, John the Ripper, and hashcat entries.