Linux runs most servers, containers and cloud workloads, yet many security and operations staff only know it well enough to copy commands they do not understand. CompTIA Linux+ is the vendor-neutral certification that tests whether you can administer, secure, automate and troubleshoot Linux systems. This guide sets out what CompTIA publishes about the current exam (XK0-006, Linux+ V8): format, the five domains and their weights, recommended experience and renewal, then adds a lab-based preparation plan and where Linux+ fits for people heading into security, cloud or platform engineering. It is written for systems administrators, Network+ and Security+ holders broadening into servers, and the managers who fund their training. Facts are as checked on comptia.org on 26 Oct 2026; CompTIA changes exams, prices and policies, so confirm on the linked pages before booking.
Key takeaways
- XK0-006 is the current exam. Linux+ V8 (XK0-006) launched on 15 July 2025, and CompTIA estimates retirement in 2028; the previous XK0-005 is no longer listed on the certification page.
- The format matches Network+. A maximum of 90 multiple-choice and performance-based questions in 90 minutes, with a passing score of 720 on a scale of 100 to 900, in English.
- Automation is now a full domain. Automation, orchestration and scripting is 17% and covers Ansible, Puppet, CI/CD, shell, Python, Git and responsible use of AI code generation.
- Security is 18% of the exam. PAM, LDAP, Kerberos, auditing, iptables, nftables and UFW, hardening, sudo, MFA and certificate management all appear.
- Renewal is 50 CEUs every three years. The CE fee is $150 for the cycle; Linux+ renews only A+, and Cloud+ is the CompTIA certification that renews Linux+.
Who the certification is for
CompTIA describes Linux+ as preparing candidates for roles such as Linux systems administrator, systems engineer and network engineer. It is an administration certification first, with a meaningful security and automation component.
- Good fit: junior and mid-level Linux or systems administrators; Windows administrators moving into mixed estates; DevOps and platform engineers who want a structured check of fundamentals; cloud engineers whose workloads run on Linux images.
- Good fit for security staff: SOC and incident response analysts who investigate Linux hosts, and security engineers who write hardening baselines. See the Linux Fundamentals for Defenders Guide for the defensive angle.
- Good fit for employers: a distribution-neutral benchmark, useful where the estate mixes Red Hat family, Debian family and container base images.
- Weaker fit: complete beginners (build general IT and networking first), and senior administrators who already hold a hands-on, distribution-specific certification and want depth on one platform rather than breadth.
- Public sector and defence: the Linux+ page checked did not list DoD 8140 work roles. If a contract requires a specific qualification, confirm acceptance with the hiring organisation.
For the full landscape of certifications by level and specialism, see the Cybersecurity Certifications Guide. This page covers Linux+ only.
Exam format and domains
Format at a glance
| Item | Linux+ V8 (XK0-006) |
|---|---|
| Launch date | 15 July 2025 |
| Retirement | Usually three years after launch; CompTIA estimates 2028 |
| Questions | Maximum of 90 |
| Question types | Multiple-choice and performance-based |
| Duration | 90 minutes |
| Passing score | 720 on a scale of 100 to 900 |
| Languages | English |
| Recommended experience | 12 months of hands-on experience with Linux servers; CompTIA A+, Network+ or Server+, or comparable knowledge |
| Accreditation | ISO accredited by the ANSI National Accreditation Board (ANAB) |
Older study material written for XK0-005 is still widely sold. Check that books, courses and practice tests state XK0-006: the domain structure changed, and automation and AI content in particular will be missing from older material.
The five domains and their weightings
| Domain | Weight | Main topics on CompTIA's page | Read more |
|---|---|---|---|
| 1. System management | 23% | Boot process, kernel and modules; filesystems; storage with LVM, RAID and partitions; host networking, DNS and network tools; shell navigation, redirection and environment variables; archiving, backup and recovery; virtualisation and disk images | Linux Fundamentals for Defenders Guide |
| 2. Services and user management | 20% | Permissions, links and special files; users and groups; processes, priorities and job scheduling; packages and repositories; services, logs and timers; container runtimes, images and networks | Linux Logging and auditd for Defenders Guide |
| 3. Security | 18% | PAM, LDAP, Kerberos and auditing; iptables, nftables, UFW and zone rules; OS hardening, sudo and secure remote access; password policy, restricted shells and MFA; file encryption, hashing and certificate management; integrity verification, scans and standards | Linux Server Hardening Guide |
| 4. Automation, orchestration and scripting | 17% | Ansible, Puppet and CI/CD tools; shell scripting with variables, functions and logic; Python environments, packages and data types; Git workflows and tagging; AI best practices for code generation and prompt engineering | SSH Key Management Guide |
| 5. Troubleshooting | 22% | Monitoring health, logs and alerts; boot, mount and storage repair; firewall, routing, DNS and connectivity faults; SELinux, permission and vulnerability issues; CPU, memory and I/O performance | Linux Detection and Response Guide |
Domain names, weights and topics are from CompTIA's Linux+ page; the last column is NHI Mgmt Group's reading suggestion. Use CompTIA's official exam objectives document for XK0-006 as your revision checklist, since the page is a summary. CompTIA's page does not name specific init systems or firewall front ends beyond those listed; in practice you will meet systemd units and timers on most modern distributions, so lab with them.
Where identity fits
The security domain is largely an identity domain: PAM stacks, LDAP and Kerberos integration, sudo rules, restricted shells and MFA. The automation domain adds the machine side. Ansible control nodes, CI/CD runners and scripts all authenticate with SSH keys, tokens or service accounts, and those credentials are frequently over-privileged and never rotated. Integrity verification and repository management appear in the objectives for the same reason: a host is only as trustworthy as the packages and signing keys it accepts. See the SSH Key Management Guide for governing the keys that automation depends on.
Prerequisites and experience
There is no mandatory prerequisite. CompTIA recommends 12 months of hands-on Linux server experience and A+, Network+ or Server+ (or comparable knowledge).
| Your starting point | Suggested route | Realistic gap to close |
|---|---|---|
| General IT support, little Linux | Network+ or equivalent networking first, then several months of daily Linux use before Linux+ | Shell fluency, permissions, package management |
| Windows administrator | Linux+ with a home lab, focusing on domains 1 and 2 | Filesystem layout, services, storage, users and groups |
| Linux administrator, 1 year or more | Linux+ as validation; concentrate on automation and security | Ansible, Python, Git, nftables, SELinux |
| Security analyst | Linux+ after Security+, with emphasis on logs, auditing and troubleshooting | Storage, boot and service administration |
| Holder of a distribution-specific hands-on certification | Usually optional; take it only if an employer asks for a vendor-neutral credential | Cross-distribution differences |
Decision guidance: choose Linux+ when you want a vendor-neutral, breadth-first credential that also counts towards a security-adjacent CompTIA stack. Choose a distribution vendor's performance-based exam when your employer standardises on that distribution and values hands-on depth. Small organisations with mixed Linux estates usually benefit from the neutral breadth; large enterprises standardised on one enterprise distribution often prefer the vendor route.
Preparation plan
- Baseline: download the XK0-006 objectives, rate yourself against each sub-objective, and take one practice test cold.
- Build a lab: two or three virtual machines from different distribution families (one RPM-based, one Debian-based) plus a container runtime. Snapshot them so you can break things safely and roll back.
- Daily shell practice: work only from the command line for routine tasks: files and permissions, users and groups, packages, services, logs and scheduled jobs.
- Storage and boot: create partitions, LVM volumes and a RAID set, mount them persistently, then deliberately break the boot or mount configuration and recover.
- Security set: configure PAM password policy, sudo rules, SSH key-only login, a host firewall with nftables or UFW, and SELinux or an equivalent mandatory access control in enforcing mode. Diagnose the denials you cause.
- Automation set: write shell and Python scripts that manage users or services, put them in Git with tags, and repeat the same change with an Ansible playbook. If you use AI code generation, review every line and test it in the lab first, which is the practice the objectives point to.
- Troubleshooting drills: have someone (or a script) introduce faults: a full disk, a broken DNS resolver, a blocked port, a wrong permission, a runaway process. Fix them against the clock.
- Final fortnight: full-length timed practice tests and simulations; review every wrong answer against the objectives; book when you pass consistently with margin.
How to measure progress: practice scores by domain, time per performance-based question, the number of lab faults you can resolve without notes, and whether you can rebuild your lab from a playbook rather than by hand.
Cost, renewal and continuing education
Exam cost: CompTIA sells vouchers through its regional online stores, alone or bundled with CertMaster training products. The voucher price was not shown on the certification page when checked, varies by region and currency, and changes; check the CompTIA store for your country before budgeting.
| Renewal item | Linux+ (as checked 26 Oct 2026) |
|---|---|
| Certification validity | Three years from the date earned or renewed |
| CEUs required per cycle | 50 |
| CE fee | $150 for the three-year cycle; it does not have to be paid annually, but all of it must be paid before expiry |
| Work experience credit | Up to 3 CEUs per year (9 per cycle), with at least 50% of the work related to the exam objectives and an employer letter on letterhead |
| Single-activity options | CertMaster CE, or earning a qualifying higher CompTIA certification |
| What Linux+ renews | A+ only; it does not renew Network+ or Security+ |
| What renews Linux+ | Cloud+ (CompTIA lists Cloud+ as renewing A+, Network+ and Linux+); Security+ and the cyber track do not |
This is the main practical difference from Network+: Linux+ sits outside the main CompTIA security hierarchy. If you hold Security+ and Linux+, renewing Security+ will not keep Linux+ current, so plan CEUs or a Cloud+ route for it separately. CompTIA advises selecting your highest certification as the "intent level" when paying fees or submitting CEUs, and CE fees are not waived where a higher certification does not fully renew a lower one.
Where it fits on the career path
| Direction | Why Linux+ helps | Typical next step |
|---|---|---|
| Systems administration | Directly validates daily administration | Distribution-specific hands-on certification |
| Cloud and platform engineering | Cloud workloads, containers and CI/CD runners are mostly Linux | CompTIA Cloud+, then a cloud provider certification |
| Security operations | Investigating Linux hosts needs logs, auditing and process knowledge | CompTIA CySA+ |
| Offensive security | Most testing tooling and many targets are Linux | CompTIA PenTest+ (authorised work only) |
| Kubernetes security | Node hardening, namespaces and container runtimes build on Linux skills | CKS |
Linux+ pairs naturally with Network+ and Security+. On its own it signals administration competence; combined with a security certification and a public lab repository (playbooks, scripts, hardening notes) it is strong evidence for security engineering and cloud roles. For broader planning, see the Cybersecurity Learning Roadmap Guide and the Security Engineer Career Guide.
Practitioner checklist
- Confirm the exam code is XK0-006 on CompTIA's Linux+ page and that all study material matches it.
- Download the objectives and rate yourself against every sub-objective.
- Build a snapshot-based lab with two distribution families and a container runtime.
- Practise LVM, RAID, mounts and boot recovery until you can do them without notes.
- Configure PAM, sudo, SSH key-only access, a host firewall and mandatory access control, and troubleshoot the denials.
- Automate one task three ways: shell, Python and Ansible, all under Git.
- Run timed troubleshooting drills and full-length practice tests.
- Check the voucher price for your region before budgeting.
- Plan renewal separately: 50 CEUs and $150 per cycle, since Security+ does not renew Linux+.
Standards and references
- CompTIA: Linux+ Certification (V8, XK0-006)
- CompTIA: Continuing Education Program FAQ
- CompTIA: Continuing Education Renewal Fees
- CompTIA: Renewing Multiple Certifications
- CompTIA: Renewing With Work Experience
- CompTIA: Network+ Certification (V9, N10-009)
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Linux Server Hardening Guide · Linux Fundamentals for Defenders Guide · SSH Key Management Guide · Cybersecurity Learning Roadmap Guide