Linux MCQ — Basics to Advanced

Linux is technically only the kernel. What people commonly call 'Linux' (Ubuntu, RHEL, etc.) is really GNU/Linux — the kernel bundled with GNU userland tools and a package manager.

Distributions (Ubuntu, RHEL, Alpine, etc.) all build on the Linux kernel but differ in package manager, file layout conventions, and default configuration.

Kernel space runs with full privileges and direct hardware access. User-space applications are restricted and must request kernel services via system calls.

open(), read(), and write() are system calls — the mechanism by which user-space code requests privileged kernel services like file I/O.

An inode stores a file's metadata (permissions, owner, size, timestamps) and pointers to its data blocks. The filename is a separate directory entry pointing to the inode.

A hard link points to the same inode as the original. Data isn't freed until the last hard link referencing that inode is deleted.

A symbolic link is a small file containing a path to its target. If the target is deleted or moved, the symlink becomes a dangling reference.

644 in octal breaks down to owner=6(rw-), group=4(r--), others=4(r--) — the standard permission set for a regular, non-executable file.

setuid makes a binary run with its OWNER's privileges. This is how /usr/bin/passwd (owned by root) lets any user update /etc/shadow, which normally requires root.

The sticky bit on a shared directory like /tmp stops users from deleting or renaming each other's files, even though everyone has write access to the directory itself.

Files default to 666 before umask is applied. Subtracting 022 gives 644 (owner rw-, group r--, others r--).

A zombie has finished executing, but its parent hasn't called wait() to reap its exit status — it holds only a PID table entry until reaped.

Orphaned processes are automatically re-parented to PID 1, which is responsible for reaping them when they eventually exit.

SIGTERM (15) is the default, catchable signal that lets an application shut down gracefully. SIGKILL (9) cannot be caught or ignored — the kernel terminates the process immediately.

Nice values range from -20 (highest priority) to 19 (lowest). The naming is intentionally inverse — a 'nicer' process yields more CPU to others, hence lower priority for itself.

`fg %1` resumes job 1 in the foreground. `bg %1` resumes a stopped job but keeps it running in the background.

initramfs is a minimal, temporary filesystem loaded into memory by the bootloader, containing just enough kernel modules to locate and mount the actual root filesystem (e.g., on LVM or an encrypted volume).

systemd is started by the kernel as the very first userspace process (PID 1), and every other process descends from it.

`systemctl daemon-reload` tells systemd to reload unit file definitions from disk. Without it, systemd keeps using the old, cached definition even after restarting the service.

After=/Before= are purely about ordering. Requires= (and the softer Wants=) express actual dependency relationships between units.

`journalctl -b` shows the current boot's logs; `journalctl -b -1` reaches back one boot — essential for investigating what happened right before an unexpected reboot.

/etc/fstab defines which devices/partitions get mounted where, automatically, when the system boots. A bad entry here is a classic cause of a server dropping into emergency mode.

df reports usage as tracked by the filesystem itself, while du sums the sizes of files it can see. A mismatch usually means a deleted file is still held open by a running process.

Unlike resize2fs (used for ext4, which can target the device), xfs_growfs operates on the mounted filesystem path, not the raw block device.

RAID 1 mirrors data across drives, surviving a single disk failure. RAID 0 stripes data for speed with zero redundancy — any disk failure loses all data.

si (swap in) and so (swap out) show active swapping. Sustained non-zero values under load are a strong signal of memory pressure, which severely impacts latency.

/etc/passwd holds an 'x' placeholder in the password field; the actual hash lives in /etc/shadow, which is readable only by root, for security.

sudo is designed for per-command, audited privilege escalation. su switches to a full session as another user and requires that user's own password.

Without -a (append), usermod -G overwrites the user's entire supplementary group list instead of adding to it — a classic and dangerous mistake.

mkfifo creates a named pipe (FIFO), letting two unrelated processes communicate through a filesystem path rather than an anonymous shell pipe.

Character devices transfer data as a stream; block devices support random access in fixed-size blocks, which is why only block devices are partitioned and formatted with filesystems.

The -v flag inverts the match, printing every line that does NOT match the given pattern.

The 'g' flag replaces every occurrence per line (not just the first), and -i edits the file in place with no output, and no undo unless a backup suffix is given.

-F sets awk's field separator. /etc/passwd uses colons to separate fields, so -F: is required to correctly extract, e.g., the username as $1.

uniq only collapses consecutive duplicate lines. If matching lines aren't adjacent, sort must be run first — hence the common `sort | uniq -c` pattern.

-c creates an archive, -z compresses with gzip, -v is verbose, -f specifies the archive filename — czvf is the standard combination for creating a .tar.gz.

--delete mirrors the destination exactly to the source, deleting anything extra in the destination. Testing with --dry-run first previews exactly what would be deleted before it actually happens.

A very common point of confusion: 'update' only refreshes what apt KNOWS is available; 'upgrade' is the step that actually installs newer package versions.

Namespaces isolate what a process can see (PID tree, network, mounts), and cgroups limit what it can use (CPU, memory, I/O). Containers are regular Linux processes constrained by these two kernel features, sharing the host's single kernel.

OOMKilled is enforced by the kernel's OOM killer, part of the memory management subsystem. dmesg/journalctl -k on the node shows the actual kernel-level kill event, which kubectl describe only surfaces indirectly.