Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. You edited a unit file in /etc/systemd/system/. What must you run before restarting the service?

   1. Areboot
   2. Bsudo systemctl daemon-reload
   3. Cjournalctl --flush
   4. Dapt update
   Show answer

   B. systemd caches unit definitions. daemon-reload makes it read your changes; otherwise it keeps using the old definition.

   From lesson 07 · systemd & journald in depth

2. Q2. Why use 'systemctl edit' instead of editing /usr/lib/systemd/system/nginx.service?

   1. AIt's faster
   2. BPackage upgrades overwrite files in /usr/lib; a drop-in in /etc/systemd/system/nginx.service.d/ survives and only changes what you specify
   3. CIt's the only way to add Restart=
   4. DIt restarts automatically
   Show answer

   B. Vendor units live in /usr/lib. Your changes belong in /etc as overrides or drop-ins, which take precedence.

   From lesson 07 · systemd & journald in depth

3. Q3. What does Restart=on-failure do?

   1. ARestarts the service every day
   2. BRestarts it if it exits with an error, crashes, or is killed by a signal
   3. CRestarts the machine on failure
   4. DNothing without a timer
   Show answer

   B. systemd supervises the process. Combined with RestartSec=, it brings crashed services back automatically, which is the same idea as a Kubernetes restart policy.

   From lesson 07 · systemd & journald in depth

4. Q4. How do you see error messages from the boot before the last reboot?

   1. Ajournalctl -f
   2. Bjournalctl -b -1 -p err (if the journal is persistent)
   3. Cdmesg -1
   4. Dcat /var/log/boot
   Show answer

   B. -b -1 selects the previous boot. It needs a persistent journal (/var/log/journal), which most server distributions enable.

   From lesson 07 · systemd & journald in depth

5. Q5. df says 100% used, but du on every directory adds up to much less. What's the classic cause?

   1. Adu is broken
   2. BDeleted files still held open by a running process
   3. CThe disk is read-only
   4. DToo many directories
   Show answer

   B. Deleting a file removes its name, but the space is only freed when no process has it open. Find them with 'lsof +L1', then restart (or signal) the process.

   From lesson 08 · Disks & filesystems

6. Q6. Writes fail with 'No space left on device' but df -h shows 40% free. What should you check?

   1. ARAM
   2. Bdf -i: the filesystem may have run out of inodes (too many small files)
   3. CThe CPU
   4. DSwap
   Show answer

   B. Each file needs an inode. Millions of tiny files (caches, sessions, mail queues) can exhaust inodes while blocks remain free.

   From lesson 08 · Disks & filesystems

7. Q7. Why run 'sudo mount -a' right after editing /etc/fstab?

   1. AIt formats the disk
   2. BIt tests the new entries now, instead of discovering a typo at the next boot (which may drop into emergency mode)
   3. CIt's required to save the file
   4. DIt resizes filesystems
   Show answer

   B. A bad fstab line can stop a server booting. Test immediately while you still have a working shell. Consider the 'nofail' option for non-critical mounts.

   From lesson 08 · Disks & filesystems

8. Q8. What does 'lvextend -r' add?

   1. AA new disk
   2. BIt also resizes the filesystem on the logical volume, so the space is usable immediately
   3. CRead-only mode
   4. DA RAID mirror
   Show answer

   B. Growing the LV alone doesn't grow the filesystem. -r runs the right resize tool (resize2fs or xfs_growfs) for you.

   From lesson 08 · Disks & filesystems

9. Q9. An app says 'connection refused' when calling db:5432. What does 'refused' usually mean?

   1. ADNS failed
   2. BThe packet reached the host, but nothing is listening on that port (or a firewall actively rejected it)
   3. CThe network cable is unplugged
   4. DThe password is wrong
   Show answer

   B. Refused = an RST came back. Timeouts, by contrast, usually mean packets are dropped (firewall, routing, host down).

   From lesson 09 · Networking from the host

10. Q10. Which command shows which process is listening on port 443?

    1. Aip route
    2. Bsudo ss -ltnp | grep ':443 '
    3. Cdig 443
    4. Dping -p 443
    Show answer

    B. ss -l (listening), -t (TCP), -n (numeric), -p (process). sudo is needed to see other users' processes.

    From lesson 09 · Networking from the host

11. Q11. curl https://api.internal hangs, but curl https://10.0.5.20 answers immediately. Which layer is suspect?

    1. ATLS
    2. BDNS resolution (or a wrong DNS answer)
    3. CThe application
    4. DThe kernel
    Show answer

    B. The IP works, so routing, the port and the app are fine. Check what the name resolves to with dig, and which resolver the host uses.

    From lesson 09 · Networking from the host

12. Q12. Why start tcpdump with -n?

    1. ATo capture more packets
    2. BTo skip reverse-DNS lookups, which are slow and can hide the real addresses
    3. CTo save to a file
    4. DTo see only new connections
    Show answer

    B. -n shows raw IPs and ports. It's faster and avoids tcpdump generating DNS traffic of its own.

    From lesson 09 · Networking from the host

13. Q13. A 4-core server shows a load average of 40, but CPU usage is low. What's a likely explanation?

    1. AThe CPUs are broken
    2. BMany processes are stuck waiting on disk or network storage (D state), which Linux counts in load
    3. CThe load average is in percent
    4. DToo much free memory
    Show answer

    B. Linux load includes tasks in uninterruptible I/O wait. High load with idle CPUs points at storage (check iostat, and D-state processes in ps).

    From lesson 10 · Performance triage

14. Q14. free -h shows 'free: 200Mi' but 'available: 6Gi'. Is the server out of memory?

    1. AYes, it will crash soon
    2. BNo: most memory is page cache that the kernel releases on demand; 'available' is the number that matters
    3. CYes, add swap now
    4. DIt depends on the CPU
    Show answer

    B. Linux uses spare RAM as a disk cache. 'available' estimates what applications can still get without swapping.

    From lesson 10 · Performance triage

15. Q15. In the USE method, what does 'saturation' mean?

    1. AThe resource is 100% used
    2. BWork is queued waiting for the resource (e.g. run queue, disk queue)
    3. CErrors occurred
    4. DThe resource is idle
    Show answer

    B. Utilisation = how busy; Saturation = how much extra work is waiting; Errors = failures. Saturation is often where latency comes from.

    From lesson 10 · Performance triage

16. Q16. Where would you look to see if the kernel killed a process for using too much memory?

    1. Als /proc
    2. Bdmesg / journalctl -k, for 'Out of memory: Killed process'
    3. Cdf -h
    4. Dip route
    Show answer

    B. The OOM killer logs to the kernel ring buffer. In containers it also shows as OOMKilled with exit code 137.

    From lesson 10 · Performance triage

17. Q17. Which part of an SSH key pair goes onto the server?

    1. AThe private key
    2. BThe public key (in ~/.ssh/authorized_keys)
    3. CBoth
    4. DNeither: the password is used
    Show answer

    B. The public key can be shared freely. The private key never leaves your machine (ideally protected by a passphrase or a hardware key).

    From lesson 11 · SSH, keys & remote work

18. Q18. SSH refuses your key with 'Permission denied (publickey)', even though the key is in authorized_keys. A common cause?

    1. AThe key is too new
    2. BPermissions on ~/.ssh (should be 700) or authorized_keys (600) are too open, or the file is owned by the wrong user
    3. CThe server is IPv6
    4. DDNS failure
    Show answer

    B. sshd ignores authorized_keys if the home, .ssh or file permissions let others write to them. Check with ssh -v on the client and the auth log on the server.

    From lesson 11 · SSH, keys & remote work

19. Q19. Why run long jobs inside tmux on a remote server?

    1. AThey run faster
    2. BThe job keeps running if your SSH connection drops, and you can re-attach later
    3. Ctmux encrypts them
    4. DIt's required for sudo
    Show answer

    B. Without tmux (or screen), a dropped connection sends a hangup to your shell and its jobs. tmux keeps the session alive on the server.

    From lesson 11 · SSH, keys & remote work

20. Q20. What does 'ssh -J bastion user@internal' do?

    1. ACopies files
    2. BConnects to 'internal' by jumping through 'bastion', with end-to-end encryption to the internal host
    3. COpens a VPN
    4. DDisables host key checks
    Show answer

    B. ProxyJump chains SSH connections. Your keys stay on your laptop; the bastion only forwards the encrypted stream.

    From lesson 11 · SSH, keys & remote work

21. Q21. A service fails to start with 'Address already in use'. What's the next command?

    1. Areboot
    2. Bsudo ss -ltnp | grep ':<port> ' to find the process already holding the port
    3. Cchmod 777 the binary
    4. Dapt reinstall
    Show answer

    B. EADDRINUSE means another process is bound to the port. Find it, then decide whether it's a stale copy to stop or a real conflict.

    From lesson 12 · Checkpoint: five broken servers

22. Q22. sshd logs 'Authentication refused: bad ownership or modes for directory /home/deploy'. Fix?

    1. ADisable SSH keys
    2. BRemove group/other write permission from /home/deploy (e.g. chmod 755) and keep ~/.ssh 700 and authorized_keys 600
    3. CRestart sshd
    4. DChange the port
    Show answer

    B. StrictModes makes sshd ignore keys when the home or .ssh directory is writable by others. Correct the modes; don't weaken sshd.

    From lesson 12 · Checkpoint: five broken servers

23. Q23. A host resolves nothing; /etc/resolv.conf says 'nameserver 127.0.0.53'. What's that address?

    1. AA public DNS server
    2. BThe local systemd-resolved stub, which must be running for lookups to work
    3. CThe default gateway
    4. DA typo
    Show answer

    B. On systemd-resolved systems, resolv.conf points at a local stub. If systemd-resolved is stopped, every lookup fails.

    From lesson 12 · Checkpoint: five broken servers