Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. What is a system call?

   1. AA phone call from the kernel
   2. BThe interface a program uses to ask the kernel to do something (open a file, send a packet, start a process)
   3. CA shell command
   4. DA cron job
   Show answer

   B. User programs can't touch hardware directly; they ask the kernel through system calls like open, read, write, connect and clone.

   From lesson 13 · Kernel, modules & sysctl

2. Q2. You set 'sysctl -w net.ipv4.ip_forward=1' and it's gone after a reboot. How do you make it permanent?

   1. ARun it in .bashrc
   2. BPut 'net.ipv4.ip_forward = 1' in a file under /etc/sysctl.d/ and run 'sysctl --system'
   3. CRecompile the kernel
   4. DEdit /proc directly
   Show answer

   B. sysctl -w changes the running kernel only. Files in /etc/sysctl.d/ are applied at every boot.

   From lesson 13 · Kernel, modules & sysctl

3. Q3. Why does a Kubernetes node need the br_netfilter module and net.bridge.bridge-nf-call-iptables=1?

   1. AFor disk encryption
   2. BSo traffic crossing Linux bridges passes through iptables, where Service and network-policy rules live
   3. CTo enable IPv6
   4. DFor faster boots
   Show answer

   B. Pod traffic often crosses a bridge. Without br_netfilter, it would bypass the iptables rules that kube-proxy and some CNIs rely on.

   From lesson 13 · Kernel, modules & sysctl

4. Q4. What do namespaces control?

   1. AHow much CPU a process may use
   2. BWhat a process can see: its own PIDs, network, mounts, hostname, users
   3. CDisk encryption
   4. DWhich kernel runs
   Show answer

   B. Namespaces isolate views of the system. Limits on how much a process can use come from cgroups.

   From lesson 14 · cgroups & namespaces

5. Q5. Inside a new PID namespace, what PID does your shell get?

   1. AIts host PID
   2. B1
   3. C0
   4. DA random number
   Show answer

   B. The first process in a PID namespace is PID 1 there, even though it has a normal PID on the host. That's why container entrypoints run as PID 1.

   From lesson 14 · cgroups & namespaces

6. Q6. A pod is OOMKilled. Which kernel mechanism enforced its memory limit?

   1. ANamespaces
   2. BThe memory controller of cgroups (memory.max in cgroup v2)
   3. CSELinux
   4. Dsysctl
   Show answer

   B. The kubelet and runtime put each container in a cgroup with memory.max set from its limit. Exceeding it triggers the OOM killer for that cgroup.

   From lesson 14 · cgroups & namespaces

7. Q7. How can you run 'ip addr' as a pod's network sees it, from the node?

   1. AIt's impossible
   2. BFind a container PID (crictl inspect) and run 'nsenter -t <pid> -n ip addr'
   3. Ckubectl logs
   4. Dping the pod
   Show answer

   B. nsenter joins an existing process's namespaces. It's the host-side way to debug a container's networking with the host's tools.

   From lesson 14 · cgroups & namespaces

8. Q8. On a two-socket server, why can memory access be slower for some processes?

   1. AThe second CPU is slower
   2. BWith NUMA, memory attached to the other socket is 'remote' and takes longer to reach than local memory
   3. CMemory is shared by disk
   4. DHyper-threading is off
   Show answer

   B. Each socket has its own memory controller. Crossing the interconnect adds latency, so placing a process's CPUs and memory on the same node helps.

   From lesson 15 · NUMA, huge pages & CPU pinning

9. Q9. What do huge pages reduce?

   1. ADisk usage
   2. BPressure on the TLB (the cache of address translations), because each page covers more memory
   3. CNetwork latency
   4. DThe number of CPUs needed
   Show answer

   B. With 2 MiB or 1 GiB pages, far fewer translations are needed, which helps memory-intensive workloads like DPDK and some databases.

   From lesson 15 · NUMA, huge pages & CPU pinning

10. Q10. With the Kubernetes CPU Manager 'static' policy, which pods get exclusive CPUs?

    1. AAll pods
    2. BGuaranteed-QoS pods whose containers request whole (integer) CPUs
    3. CBestEffort pods
    4. DPods with a PriorityClass
    Show answer

    B. Only Guaranteed pods with integer CPU requests are pinned to dedicated cores. Everything else shares the remaining pool.

    From lesson 15 · NUMA, huge pages & CPU pinning

11. Q11. What does a flame graph show?

    1. ANetwork traffic over time
    2. BSampled stack traces, where the width of each box is the share of CPU time spent in that function (and its children)
    3. CDisk usage per directory
    4. DTemperature of the CPU
    Show answer

    B. Wide boxes are where time goes. You read upwards from the bottom: callers below, callees above.

    From lesson 16 · Tracing with perf & eBPF

12. Q12. Why is eBPF attractive for production troubleshooting?

    1. AIt requires a kernel rebuild
    2. BSmall verified programs run safely inside the kernel, observing events with low overhead and no restarts
    3. CIt replaces all logs
    4. DIt only works in containers
    Show answer

    B. The kernel verifier checks eBPF programs before they run, so they can't crash the kernel. That makes live tracing on production hosts practical.

    From lesson 16 · Tracing with perf & eBPF

13. Q13. A service is slow, and iostat shows the disk isn't very busy. Which tool shows whether the few I/Os it does are slow?

    1. Aexecsnoop
    2. Bbiolatency (a latency histogram per I/O)
    3. Ctcpconnect
    4. Dperf top
    Show answer

    B. Averages hide outliers. biolatency shows the distribution: a long tail of slow I/Os can hurt even when utilisation is low.

    From lesson 16 · Tracing with perf & eBPF

14. Q14. nginx on RHEL returns 403 for files in /srv/www, although permissions are 644. ls -Z shows 'default_t'. Best fix?

    1. Asetenforce 0
    2. BLabel the path as web content: semanage fcontext -a -t httpd_sys_content_t '/srv/www(/.*)?' then restorecon -Rv /srv/www
    3. Cchmod 777 /srv/www
    4. DReinstall nginx
    Show answer

    B. SELinux blocks nginx (httpd_t) from reading default_t files. Recording the correct label in policy and applying it fixes it permanently and keeps protection on.

    From lesson 17 · SELinux & AppArmor

15. Q15. What does Permissive mode do?

    1. ADisables SELinux entirely
    2. BLogs what would be denied but allows it: useful for diagnosis, not as a permanent fix
    3. CBlocks everything
    4. DOnly protects root
    Show answer

    B. Permissive shows every denial the policy would make, without blocking. Use it briefly to collect denials, then fix and return to Enforcing.

    From lesson 17 · SELinux & AppArmor

16. Q16. How is AppArmor different from SELinux in how it identifies what to protect?

    1. AIt isn't
    2. BAppArmor profiles are attached to program paths; SELinux uses labels (contexts) on files and processes
    3. CAppArmor only works on network traffic
    4. DSELinux only works in containers
    Show answer

    B. AppArmor rules say 'this program may access these paths'. SELinux rules say 'this process type may do this to that object type', based on labels.

    From lesson 17 · SELinux & AppArmor

17. Q17. What's the first step in hardening a server?

    1. AInstall antivirus
    2. BReduce the attack surface: remove or disable services and packages that aren't needed
    3. CChange the hostname
    4. DEnable swap
    Show answer

    B. Everything that listens or runs is something that could be attacked. The safest service is the one that isn't installed.

    From lesson 18 · Host hardening

18. Q18. You're about to set 'PasswordAuthentication no' in sshd_config remotely. What protects you from locking yourself out?

    1. ANothing, just reboot
    2. BConfirm key login works, validate with 'sshd -t', reload, and test a NEW session while keeping the current one open
    3. CDisable the firewall first
    4. DUse root
    Show answer

    B. An existing session survives a reload. If the new login fails, you can still fix the config from the old one.

    From lesson 18 · Host hardening

19. Q19. What does an auditd watch like '-w /etc/sudoers -p wa -k sudoers' record?

    1. AEvery read of any file
    2. BWrites and attribute changes to /etc/sudoers, tagged with the key 'sudoers'
    3. CNetwork connections
    4. DFailed logins only
    Show answer

    B. -w watches a path, -p wa selects write and attribute changes, -k tags events so 'ausearch -k sudoers' finds them.

    From lesson 18 · Host hardening

20. Q20. Why measure against a CIS benchmark?

    1. AIt makes servers faster
    2. BIt gives a consistent, auditable checklist of secure settings, and tools to scan how far a host deviates
    3. CIt's required by Linux
    4. DIt replaces patching
    Show answer

    B. Benchmarks turn 'is it hardened?' into a measurable score, and scanning tools (OpenSCAP, Ubuntu Security Guide) make it repeatable.

    From lesson 18 · Host hardening

21. Q21. Why capture a baseline before changing anything?

    1. AIt's required by Linux
    2. BWithout 'before' numbers you can't prove a change helped, or notice that it hurt
    3. CTo fill disk space
    4. DTo slow the server down
    Show answer

    B. Every change should be justified by evidence. The baseline is the reference that turns opinions into measurements.

    From lesson 19 · Capstone: harden & tune a host

22. Q22. Your tuning change makes the p50 latency better but the p99 worse. What do you do?

    1. AKeep it: p50 improved
    2. BInvestigate or roll back: tail latency is often what users notice, so the change isn't a clear win
    3. CIgnore percentiles
    4. DReboot
    Show answer

    B. Averages and medians hide the slowest requests. Decide against user-facing goals, usually expressed as a high percentile.

    From lesson 19 · Capstone: harden & tune a host