Linux System Administration Flashcards

Question 1

What is the root directory in Linux and what does it contain?

Accepted Answer

The root directory, written as a single forward slash, is the top of the single directory tree in Linux. Every other file, device, and mount point lives beneath it. Common subdirectories include /etc for system configuration, /home for user home directories, /var for variable data such as logs, and /usr for installed programs.

Question 2

What is the difference between an absolute path and a relative path?

Accepted Answer

An absolute path starts at the root directory and begins with a forward slash, so it means the same place no matter where you are. A relative path starts from the current working directory and does not begin with a slash. For example, /var/log is absolute, while log depends on where you are.

Question 3

Which command prints your current working directory, and which command lists its contents?

Accepted Answer

The pwd command prints the absolute path of the directory where your shell is currently working. The ls command lists the files and subdirectories inside a directory, and ls -l adds details such as permissions, owner, size, and modification time. Running cd followed by a path changes the working directory.

Question 4

What is the purpose of the mount command and the /etc/fstab file?

Accepted Answer

The mount command attaches a filesystem, such as a disk partition or network share, to a directory called a mount point so its contents become reachable through the directory tree. The /etc/fstab file lists filesystems that should be mounted automatically at boot, along with their mount points and options.

Question 5

Why is it important to know the difference between a hard link and a symbolic link?

Accepted Answer

A hard link is another name for the same inode, so it works only within one filesystem and cannot point to a directory. A symbolic link is a file storing a path to its target, so it can cross filesystems and point to directories, but it breaks if the target moves or is removed.

Question 6

What information does an inode store about a file?

Accepted Answer

An inode is a data structure on a filesystem that stores a file's metadata, including its owner, group, permissions, size, timestamps, and pointers to the disk blocks holding its data. The file name is not stored in the inode but in a directory entry that maps the name to the inode number.

Question 7

What is the purpose of the df and du commands?

Accepted Answer

The df command reports disk space usage for mounted filesystems, showing total, used, and available capacity for each one. The du command estimates how much space a directory tree consumes by adding up file sizes beneath a given path, which helps locate what is filling a disk.

Question 8

Why might a disk report full while du shows little usage in the directories?

Accepted Answer

A common cause is a file that was deleted while a process still held it open, so its space is not released until the process closes it. Checking lsof for deleted open files helps identify the process holding the space. Restarting that process releases the space.

Question 9

What are the three basic permission types in Linux and what does each mean for a file?

Accepted Answer

The three basic permissions are read, write, and execute. Read allows viewing a file's contents, write allows modifying or truncating it, and execute allows running it as a program or script. For directories, read lets you list entries, write lets you create or delete entries, and execute lets you enter the directory.

Question 10

How does the numeric notation 755 map to a permission set?

Accepted Answer

Each digit represents one class, in order of owner, group, and others, and each digit is the sum of read as 4, write as 2, and execute as 1. So 755 gives the owner 7 (read, write, execute), the group 5 (read and execute), and others 5 (read and execute).

Question 11

What is the purpose of the chmod command and how is it used?

Accepted Answer

The chmod command changes the permissions on files and directories. It accepts either numeric mode such as chmod 640 report.txt or symbolic mode such as chmod u+x script.sh, which adds execute permission for the owner. Only the file owner or root can change a file's permissions.

Question 12

What is the purpose of the umask setting in Linux?

Accepted Answer

The umask is a mask that removes permission bits from the default permissions given to newly created files and directories. A common umask of 022 results in new files with mode 644 and new directories with mode 755. The umask is set per shell or process, so it affects what that environment creates.

Question 13

What are the special permission bits setuid, setgid, and the sticky bit used for?

Accepted Answer

Setuid makes a program run with the privileges of its file owner rather than the user who starts it, and setgid does the same for the group. On a directory, setgid causes new files to inherit the directory's group. The sticky bit on a directory allows users to delete only the files they own.

Question 14

Why should administrators avoid giving untrusted programs the setuid bit?

Accepted Answer

A setuid program runs with the owner's privileges, often root, so any bug in it can let an attacker gain those privileges. Administrators keep setuid programs few and well maintained, and they audit which files carry the bit using find with the perm test.

Question 15

What is the difference between the root account and a user with sudo privileges?

Accepted Answer

The root account is the superuser with unrestricted access to the whole system. A user with sudo privileges is a regular account allowed to run specific commands as root after authenticating, and each command can be logged. Administrators usually prefer sudo because it limits power and records who did what.

Question 16

How do you safely verify a user's group memberships on a system?

Accepted Answer

The id command shows a user's numeric user ID, primary group, and every supplementary group. Running id followed by a username displays the same details for that account, and the command changes nothing. The groups command gives a shorter list of group names.

Question 17

What is a process, and how does it differ from a program?

Accepted Answer

A program is a file of instructions stored on disk, while a process is a running instance of that program with its own memory, file descriptors, and process ID. One program can have many processes running at once. Each process is tracked by the kernel until it exits.

Question 18

What do the process states R, S, D, and Z mean in ps output?

Accepted Answer

R means running or runnable, S means interruptible sleep while waiting for an event, D means uninterruptible sleep, usually waiting on disk or other I/O, and Z means zombie, a process that has exited but whose parent has not yet collected its exit status.

Question 19

What is the difference between SIGTERM and SIGKILL when stopping a process?

Accepted Answer

SIGTERM asks a process to shut down, and the process can catch the signal, clean up files or connections, and exit gracefully. SIGKILL cannot be caught or ignored, so the kernel ends the process immediately without any cleanup. Administrators send SIGTERM first and use SIGKILL only when a process does not respond.

Question 20

What is the role of systemd as the init system on many Linux distributions?

Accepted Answer

Systemd is the first process the kernel starts, with process ID 1, and it is responsible for bringing up and supervising the rest of the system's services. It manages units such as services, sockets, and timers, and it provides the systemctl command for starting, stopping, enabling, and checking them.

Question 21

What does systemctl enable do, and how does it differ from systemctl start?

Accepted Answer

The systemctl start command launches a service immediately, while systemctl enable creates the links that make the service start automatically at boot. The two are independent, so a service can be running now without starting at boot, or enabled for boot without currently running. Use systemctl enable, now to do both at once.

Question 22

How can you view recent log messages for a single systemd service?

Accepted Answer

Use the journalctl command with the -u option followed by the unit name, such as journalctl -u nginx. Adding -f follows new messages as they arrive, and -n 50 limits output to the last fifty lines. Logs for a service are also useful when systemctl status shows it failed.

Question 23

What is a cron job and how is its schedule written in a crontab entry?

Accepted Answer

A cron job is a command that runs automatically on a repeating schedule. A crontab entry has five time fields, for minute, hour, day of month, month, and day of week, followed by the command. For example, 30 2 * * 1 runs the command at 2:30 each Monday.

Question 24

Why should a service run under a dedicated unprivileged account rather than root?

Accepted Answer

Running a service under its own unprivileged account limits the damage if the service is compromised, because the attacker inherits only the few permissions that account has. Many systemd units support this through the User= setting, and sandboxing options such as ProtectSystem can further restrict what the service can modify.

Question 25

What is the difference between a package manager and a software repository?

Accepted Answer

A package manager is the tool, such as apt, dnf, or zypper, that installs, upgrades, and removes software while tracking dependencies in a local database. A repository is a server or mirror that stores packages and metadata, and the package manager downloads from configured repositories.

Question 26

What do the apt update and apt upgrade commands each do?

Accepted Answer

The apt update command refreshes the local package index by downloading the latest lists of available packages and versions from configured repositories, but it installs nothing. The apt upgrade command then installs newer versions of packages already installed, using the refreshed index. Running update first is the usual order so upgrades use current information.

Question 27

What is a dependency, and why do package managers resolve dependencies automatically?

Accepted Answer

A dependency is another package or library that a program needs in order to run, such as a shared library providing common functions. Package managers resolve dependencies automatically so that installing one package also installs everything it requires, avoiding broken software and missing files.

Question 28

What steps does the Linux boot process follow after firmware hands control to the bootloader?

Accepted Answer

The bootloader loads the Linux kernel and an initial RAM filesystem into memory and passes control to the kernel with boot parameters. The kernel initializes hardware and mounts the root filesystem, then starts the init system, which is PID 1. The init system then starts services until the system reaches its default target.

Question 29

Where does apt store the list of configured repositories on Debian based systems?

Accepted Answer

On Debian and Ubuntu systems, repository definitions live in /etc/apt/sources.list and in files under /etc/apt/sources.list.d, which apt reads when it updates its index. Each entry gives a URL, a release name, and the components to use. Adding a third-party repository means creating a new file in that directory and running apt update.

Question 30

What does the GRUB bootloader's configuration file control, and how is it normally changed?

Accepted Answer

The GRUB configuration controls the menu entries, default boot choice, timeout, and kernel parameters passed at startup. Administrators edit /etc/default/grub and then regenerate the active configuration with a tool such as update-grub or grub-mkconfig, rather than editing the generated file directly.

Question 31

Why would an administrator review the kernel parameters on the boot line when troubleshooting?

Accepted Answer

Boot line parameters can change how the kernel behaves, such as enabling single user or recovery mode, selecting a root device, or setting console output. A mistaken or leftover parameter can prevent the system from booting, so reading /proc/cmdline on the running system helps explain unexpected behavior.

Question 32

What is a kernel module and how do administrators list the modules currently loaded?

Accepted Answer

A kernel module is a piece of code that can be loaded into the running kernel to add support for hardware or features without rebooting. The lsmod command lists the modules currently loaded. Tools such as modprobe load a module along with its dependencies, while rmmod removes one that is no longer needed.

Question 33

What is a partition, and how does it differ from a logical volume?

Accepted Answer

A partition is a fixed, contiguous region of a physical disk defined in its partition table, so resizing it is often awkward. A logical volume is created by LVM on top of physical volumes, which can span several disks and be resized or snapshotted while in use.

Question 34

What does the lsblk command display about block devices?

Accepted Answer

The lsblk command lists block devices such as disks and partitions in a tree, showing each device's name, size, type, and mount point. It shows how partitions and logical volumes are nested under their parent disks, which makes it useful for checking a layout before making changes.

Question 35

Why should fsck be run on an unmounted filesystem?

Accepted Answer

Running fsck on an unmounted filesystem avoids damage, because fsck checks and repairs filesystem structures and a mounted filesystem may change during repair. Unmounting keeps the filesystem still during repair, so fixes rest on a stable state. Many systems run fsck automatically at boot when needed.

Question 36

What is the role of the system logging daemon, and where are its files usually stored?

Accepted Answer

On many distributions, systemd-journald collects messages from the kernel, services, and applications into a binary journal, which journalctl reads. Traditional syslog daemons such as rsyslog can forward or write plain text files, usually under /var/log, such as /var/log/auth.log or /var/log/messages depending on the distribution.

Question 37

What does logrotate do, and why is it needed on a busy server?

Accepted Answer

The logrotate tool renames, compresses, and eventually deletes log files on a schedule, creating fresh files for the logging services to write to. Without it, logs on a busy server can grow until they fill the disk, which can stop services and hide the events an administrator needs to see.

Question 38

Which command shows free inodes on a filesystem, and why would that matter?

Accepted Answer

The df -i command reports inode usage for each mounted filesystem, showing how many inodes are used and free. A filesystem can run out of inodes even when plenty of disk space remains, which happens when huge numbers of tiny files are created, such as session files or mail queue entries.

Question 39

What does the nofail option in /etc/fstab do during boot?

Accepted Answer

The nofail option tells the boot process to continue even if a listed filesystem cannot be mounted, so a missing or failed disk does not stop the system from reaching a usable state. Without it, a missing entry can drop the system into emergency mode until someone fixes the configuration.

Question 40

What steps should an administrator take before deleting large log files?

Accepted Answer

First confirm which process owns or writes to the file, since deleting a log that a service still has open may not free space. Prefer rotating or truncating in place with a tool like logrotate. After the change, recheck usage with df to confirm the space was actually reclaimed.

Linux System Administration Flashcards

1Filesystem Basics and Navigation

2Users, Groups and Permissions

3Processes and Services

4Packages and Boot Process

5Storage and Logging

Learning Resources