An operating system manages CPU time, memory, storage and devices on behalf of running programs, and Linux is the usual environment for backend and DevOps work. Questions cover processes and threads, CPU scheduling, virtual memory and page replacement, synchronization, race conditions, deadlocks, I/O multiplexing, kernel design, file descriptors and practical Linux usage.
All 38 Linux & OS quiz questions below come with a short explanation, visible right on the page — no sign-in needed. They're grouped by beginner and intermediate levels and 23 subtopics, so you can revise one part at a time. Choose Try Linux & OS quiz above to take a scored run and review the questions you got wrong.
chmod 644 file.txt grant?Answer: C
Owner: read + write (4+2=6). Group: read (4). Others: read (4). Mnemonic: 4 read, 2 write, 1 execute, summed per group in owner–group–other order.
References
ps aux | grep 3000 to search the process listlsof -i :3000, or ss -ltnpcurl localhost:3000 to see what comes backnetstat -a and scan the list by eyeAnswer: B
lsof -i :3000 or ss -ltnp | grep 3000 — both give the PID and process name. ss is the modern replacement for netstat; the flags -ltnp mean listening, TCP, numeric, with process.
References
chmod 777 to be sure it can be read without an errorStrictHostKeyChecking no to the SSH configurationchmod 600 on the private key fileAnswer: D
chmod 600 ~/.ssh/id_ed25519 — read/write for the owner only. SSH deliberately refuses a private key that others on the same machine can read, because such a key must be treated as compromised.
References
grep -c ERROR app.logcat app.log | grep ERROR | wc -lawk /ERROR/ app.log and count the results by eyeAnswer: A
grep -c ERROR app.log. For large logs grep is very fast because it streams. To count per group add sort | uniq -c; to follow live use tail -f app.log | grep ERROR.
References
& to the end of the command to run it in the backgroundClientAliveInterval in the SSH server's configurationtmux or screen; nohup for something simplesudo so the process belongs to rootAnswer: C
tmux (or screen) is the best choice: the process runs in a detached session, so you can disconnect and reattach to keep watching. nohup command & is enough for simple cases where you don't need interactive output.
References
sftp and pick the new files by handrsync -avz, because it transfers only the differencesscp -r every time to be sure it is completeAnswer: C
rsync -avz src/ user@host:/dest/. It compares both sides and transfers only what differs, so later syncs are very fast. -a preserves permissions and timestamps, -v prints details, -z compresses in transit.
References
docker group but still gets permission denied. Why?docker group needs sudo rights to workAnswer: B
The group list is loaded at login, so the current session does not see the new group yet. Log out and back in (or newgrp docker for the current shell). Check with id — if docker is not listed, the session is still stale.
References
trap to catch every signal sent to the script#!/bin/bash is enough for any bash scriptset -x to print every command before running itset -euo pipefailAnswer: D
set -euo pipefail: -e stops when a command fails, -u errors on use of an undeclared variable, -o pipefail makes a pipeline fail if any command in it fails (not just the last one).
References
backup.tar.gz into a specific directory — which command?unzip backup.tar.gz -d /target/dirtar -xzf backup.tar.gz > /target/dirtar -xzf backup.tar.gz -C /target/dirgunzip backup.tar.gz and copy the files overAnswer: C
tar -xzf backup.tar.gz -C /target/dir. Mnemonic for the flags: x extract, z gzip, f file, C change directory. To compress, swap x for c, and add v if you want to see the file list.
References
/tmp and /var/tmp differ?/tmp is root-only while /var/tmp is for everyone/var/tmp lives in RAM so it is faster than /tmp/tmp is usually cleared at reboot while /var/tmp persistsAnswer: C
/tmp holds short-lived temp files, usually cleared on reboot (and on many distributions mounted as tmpfs, i.e. in RAM). /var/tmp survives reboots and is for temp files that need to live longer.
References
Answer: B
SIGTERM (the default of kill) can be caught: the process runs a handler to close connections, flush data, then exit. SIGKILL (kill -9) is carried out by the kernel, cannot be caught and cannot be ignored — the process stops immediately.
References
df -h shows a full disk but du -sh / totals far less. Why?du cannot count hidden files so its total is smallerdf includes the space reserved for rootAnswer: C
Usually it's a deleted file still held open by a process: the filename is gone but the file descriptor remains, so the space isn't reclaimed. Find it with lsof | grep deleted, fix it by restarting that process.
References
Answer: A
Kernel OOM killer: when RAM and swap are both exhausted, the kernel picks a process (usually the biggest consumer, by oom_score) to kill to keep the system alive. It is not the fault of the process that got selected.
References
Answer: A
On average 8 processes are running or waiting in the measured interval. Against 4 cores the machine is carrying double its capacity — everything slows down because things have to queue. The three numbers are the 1, 5 and 15 minute averages.
References
Answer: D
The process has finished but its parent has not called wait() to read the exit status, so the kernel keeps an entry in the process table. It uses no CPU or memory — it only occupies a slot in the table.
References
ulimit -n to its maximum and call it doneulimit -n and the number of open fds, and look for the leakAnswer: B
Check the limit with ulimit -n, check actual usage with lsof -p <pid> | wc -l. If the fd count grows steadily over time, that is a leak — connections or files not being closed. Raising the limit only buys time.
References
Type=simple so systemd tracks the right main processWantedBy=multi-user.target in the Install sectionAfter=network.target to wait for the networkRestart=always with RestartSec in [Service]Answer: D
Restart=always (or on-failure) in [Service], plus RestartSec=5 to wait between attempts. The default is Restart=no — systemd runs the service once, and once it dies, it stays dead.
References
Answer: A
A symlink stores a path (like a shortcut): if the original file is deleted or moved, the link breaks. A hard link is another name for the same inode: deleting the original name leaves the data intact because another name still points to it.
References
Answer: D
logrotate: rotate files by size or time, compress old copies, keep N copies then delete. Crucially it sends a signal (or uses copytruncate) so the process reopens the file — deleting by hand does not reclaim the space.
References
2>&1 do in command > out.log 2>&1?Answer: D
Redirects stderr (2) to the same destination that stdout (1) currently points to — here out.log. That way both normal output and errors land in the same file, which matters for cron jobs because errors also need to be captured.
References
PATH and no profile loadedAnswer: A
cron's environment is very minimal: short PATH, no .bashrc or .profile loaded, none of your environment variables. So node or pnpm that work in your terminal become "command not found" in cron.
References
free -h shows memory nearly full but apps run fine. Why?free counts the memory of processes that have already exitedAnswer: B
Most of the "used" memory is page cache — the kernel keeps disk data in RAM for fast reads and releases it as soon as an app needs it. Look at the available column instead of free: free RAM is wasted RAM.
References
Answer: A
Containers share the host kernel (isolated via namespaces and cgroups), while a VM runs its own kernel on top of a hypervisor. That's why containers start in a few hundred ms and use little RAM, but isolation is weaker than a VM's.
References
nsswitch.conf line hosts: for lookup order./etc/hosts only as a fallbackAnswer: B
Check /etc/nsswitch.conf, the hosts: line, to see the resolution order. /etc/hosts may be consulted before DNS, but not always; the actual order is decided by configuration.
References
.log files older than 30 days in a large tree. Safe approach?ls -R | grep .log and delete from the printed listfind . -name "*.log" | xargs rm for brevityrm -rf *.log in each subdirectory in turnfind . -name "*.log" -mtime +30 -delete, after a dry runAnswer: D
find . -name "*.log" -mtime +30 -delete. Always run it without -delete first to review the list. If you must pipe to another command, use -print0 | xargs -0 so filenames with spaces don't break it.
References
umask of the process creating the fileAnswer: B
umask — the mask of bits that get removed. With umask 022, a file created with requested mode 666 becomes 644, and a directory 777 becomes 755. Change it with umask 002 if you want group write.
References
mount command to root's .bashrc@reboot/etc/fstab, preferring the UUID over the device nameAnswer: D
Add a line to /etc/fstab using the UUID (get it with blkid) rather than /dev/sdb1 — device order can change between boots, and mounting the wrong disk is a serious incident.
References
Answer: A
A little swap acts as a buffer so short memory spikes don't immediately lead to an OOM kill, with a low vm.swappiness (10–20) so the kernel prefers keeping data in RAM. But if the system swaps continuously, you need more RAM, not more swap.
References
journalctl | grep <service> and hunt by timestampsystemctl status <service> to see the whole logjournalctl -u <service> --since "30 min ago"cat /var/log/syslog | tail -1000Answer: C
journalctl -u <service> --since "30 min ago". Add -f to follow live, -p err to see only error level, -n 200 for the last 200 lines, --no-pager when piping to another command.
References
Answer: A
Keep the system and logs in UTC, and convert to local time at the display layer (dashboard, UI). That way you don't have to convert when comparing logs across machines and regions, and there's no drift from daylight saving conventions.
References
top?%MEM column, since a memory-hungry process is CPU-hungry too%CPU column, remembering 100% means one full coreTIME+ column because it shows current consumptionload average line at the top of the screenAnswer: B
The %CPU column (press P to sort by it). Note 100% = one full core, so a multithreaded process on an 8-core machine can show up to 800%. Press 1 to see each core individually, M to sort by memory.
References
Answer: D
Bottom-up: (1) getent hosts B — is the name resolving correctly; (2) nc -vz B 443 or curl -v — does the port respond; (3) only if it responds, then check TLS, path, authentication, and application logs.
References
visudoAnswer: D
Declare a single line for exactly that command in sudoers via visudo, e.g. deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp. Use visudo because it checks the syntax before saving — an editing mistake can lock you out of sudo entirely.
References
curl — which flag diagnoses, which merely hides it?-L to follow the redirect to the right address-k to confirm the problem is the certificate and then keep it--compressed to reduce the data while checking-v to see the handshake detail; -k merely hides itAnswer: D
-v (or openssl s_client -connect host:443) shows the certificate chain, the names on the certificate, and its expiry date. -k merely bypasses the check — use it to confirm a hypothesis, not to keep in code.
References
ps -p <pid> -o args to see the command linelsof -p <pid> or looking at /proc/<pid>/fddu -sh on the process's working directorynetstat -a to see every connection on the machineAnswer: B
lsof -p <pid> lists every file descriptor: regular files, sockets, pipes, even deleted-but-still-held files. The equivalent is reading /proc/<pid>/fd — useful when lsof isn't installed.
References
.bashrc are missing for non-interactive SSH commands. Why?Answer: A
A Bash login shell reads /etc/profile, then the first existing file among ~/.bash_profile, ~/.bash_login, or ~/.profile; an interactive non-login shell reads ~/.bashrc; a non-interactive shell usually reads none of these unless BASH_ENV is set or they are explicitly sourced.
References
Answer: C
Three main benefits: logs go into the common system log so they are searchable like any service; dependency declarations to run after the network or another service is ready; and catch-up runs when the machine was off at the scheduled time.
References
Answer: A
Press the suspend key combination to stop the process, then use the command to continue it in the background. To have it survive after the session closes, detach it from the shell with the disown command, or use a terminal multiplexer from the start.
References
Advanced goes deep on real-world scenarios and the technical pitfalls candidates actually run into. Included with Pro.
Upgrade to Pro