Linux Interview Questions

This page collects interview questions that are actually asked of junior and mid-level DevOps engineers and system administrators. Every question here is answerable from the material already covered in this Linux course — nothing requires outside reading.

Use them as a self-check: read a question, answer it out loud or in writing without looking anything up, then open the linked article and compare. If you cannot answer a question in your own words, that article is the one to re-read.

Questions are grouped by the module they come from and numbered continuously, so the list can grow as more modules are added.

02. Shell and Terminal

Shell and Bash

Source: Shell va Bash qanday ishlaydi?

1. What is the difference between a terminal emulator, a shell, and the kernel? Walk through every layer involved between pressing Enter on cat /etc/hostname and the file's contents appearing on screen.

2. Why is cd a shell builtin rather than an external program under /usr/bin? What would break if cd shipped as a separate binary?

3. echo $SHELL prints /bin/bash, but you suspect the process you are typing into is not Bash. How do you determine which shell is actually running right now, and why is $SHELL not proof?

4. Describe what Bash does to a command line before the external program starts. Name the processing steps in order, and say which of them turns echo ~/lab/*.conf into a list of filenames.

5. With project='demo api', why do printf '<%s>\n' "$project" and printf '<%s>\n' $project produce different output? What role does IFS play, and why is the quoted form the safe default in scripts?

6. A script builds a filename from user-supplied input and runs eval "cat $filename". Explain the security problem concretely: what does eval do that plain cat $filename does not, and what does an attacker gain?

7. What is an exit status, where is the previous command's status stored, and why does ls /etc; echo "done"; echo "status=$?" not report what you expect? How do you preserve a status you need to check later?

8. Explain the difference between an interactive shell, a login shell, and a non-interactive shell. How do you check, from inside a running shell, which of these you are in — and which startup files does each read?

Command Syntax and Help Documentation

Source: Buyruq sintaksisi va yordam hujjatlari

9. You run ls -z /var/log and get ls: invalid option -- 'z' with exit status 2. Why do GNU tools return 2 here rather than 1, and why does that distinction matter to a script deciding whether to retry a command?

10. A command name behaves differently on two servers. Why is type -a a better diagnostic than which, and what kinds of "command" can type -a reveal that which cannot?

11. What is PATH, in what order does Bash search it, and why should . never be placed at the front of root's PATH on a server?

12. A file is named -draft.txt. Why does rm -draft.txt fail, and what does -- do in rm -i -- -draft.txt? Does -- by itself make the command safe?

13. What is the difference between man 1 passwd and man 5 passwd, and when would you use help cd instead of man cd?

File and Directory Commands

Source: Fayl va katalog buyruqlari

14. In ls -l output, what is the number in the third column (the link count)? Why does a freshly created empty directory show 2, and why does adding one subdirectory make it 3?

15. Explain the difference between a hard link and a symbolic link in terms of inodes. What happens to each when the original file is deleted, and why can a hard link not cross filesystem boundaries?

16. Strictly speaking, rm does not delete a file. What does it actually remove, and when is the underlying data really freed?

17. Is mv within one filesystem the same operation as mv across two filesystems? Explain what happens in each case, and what that means for a large move that gets interrupted.

18. You run a command and get Permission denied. Before reaching for sudo, what do you check and with which commands? Why is "just use sudo" a bad habit here?

Viewing Text Files

Source: Matn fayllarini ko'rish

19. A log file is 500 MB. Why is cat the wrong tool, and how do you choose between less, head, and tail for a given task?

20. A service's log is rotated at midnight and your tail -f stops showing new lines even though the service is still logging. Explain the mechanism behind this, and what tail -F does differently.

21. wc -l reports one line fewer than you can visually count in a file. What exactly does wc -l count, and how would you create a file that reproduces this?

22. You need to read /var/log/auth.log and get Permission denied. Name the possible resolutions in order of preference, and explain why running chmod on the log file is the wrong fix — including what log rotation will do to your change.

Terminal Text Editors: Nano and Vim

Source: Terminal matn muharrirlari: Nano va Vim

23. Vim's three modes: name them, say how you enter and leave each, and explain what a beginner is doing wrong when typed text does not appear.

24. You edit a file, run :w, and Vim answers E212: Can't open file for writing. List the possible causes, the command you would run to test each, and the safe way to save the buffer if the file genuinely requires elevated privilege.

25. Vim shows an E325: ATTENTION swap file prompt offering [O]pen Read-Only, (E)dit anyway, (R)ecover, (Q)uit, (D)elete it. What does each choice do, which is the safe default, and what must you verify before choosing D?

Aliases and Environment Variables

Source: Aliaslar va muhit o'zgaruvchilari

26. Compare an alias, a shell variable, and an environment variable: who uses each, and which are inherited by child processes? How would you prove the inheritance rule at a prompt?

27. Why do aliases defined in ~/.bashrc not work inside a shell script or a cron job? What should a script use instead?

28. A maintenance script runs correctly over SSH but fails under cron. How do you reproduce and diagnose the difference instead of guessing, and where does the correct fix belong — in the script, or in the crontab?

29. What is wrong with export PATH="$HOME/.local/bin", and what is the correct form? After changing PATH, why might Bash still run the old binary, and how do you clear that?

30. What is LD_PRELOAD, which component actually reads it, and why does sudo strip it from the environment? Describe a concrete way it can make a program report something untrue about its own state.

03. Text, Search, and Streams

Finding Files and Searching Text

Source: Finding Files and Text

31. find, locate, and grep — which question does each one answer? Give a task where reaching for the wrong one produces a misleading result.

32. Why must the pattern in find . -name '*.log' be quoted? What happens when it is not, and why is that failure sometimes invisible in a test directory?

33. find / -name '*.conf' 2>/dev/null is a very common habit. Explain precisely what it hides, why an audit built on it can silently under-report, and what you would do instead.

34. GNU grep returns exit status 0, 1, or 2. What does each mean, and what breaks in a script that treats 1 as a failure — or treats 2 as "nothing matched"?

35. What is the difference between grep -F, plain grep, and grep -E? Why should a search term that came from user input be passed as grep -F -- "$needle"?

36. Why do find -print0 and xargs -0 exist? What property of Linux filenames makes whitespace-splitting tools unsafe, and why does this class of bug typically surface only in production?

Streams, Pipes, and Redirection

Source: Streams, Pipes, and Redirection

37. Why does cmd > file 2>&1 capture both streams while cmd 2>&1 > file does not? Explain what 2>&1 actually means and why redirection order decides the outcome.

38. grep 'nothing-here' app.log | sort exits with status 0 even though grep matched nothing. Why? What does set -o pipefail change, and why is it not automatically the right setting?

39. What is PIPESTATUS, what does it give you that $? cannot, and what is the one rule you must follow when using it?

40. A counter incremented inside ... | while read line; do ((count++)); done is still 0 after the loop. Explain why, and give two ways to fix it.

41. Why is command > report.txt risky for a report that other systems consume? Describe the mktemp → validate → mv pattern and why the rename must happen within the same filesystem.

42. What does tee do, and why is printf '...' | sudo tee /etc/app/file used instead of sudo command > /etc/app/file? What are the risks of that pattern in production?

Rewriting Text: sed and awk

Source: Rewriting Text: sed and awk

43. Does sed 's/staging/production/' app.conf modify the file? What does -i change, and what is the difference between -i and -i.bak?

44. In s/pattern/replacement/, what does an unescaped & mean in the replacement half? Why does that make a replacement string assembled from untrusted input dangerous?

45. Explain sed's pattern space and hold space. Which commands move data between them, and when do you actually need the hold space instead of a plain line-by-line substitution?

46. In awk, what is the difference between NR and FNR? Describe the bug that appears when a script written for one file is later pointed at several files.

Archiving and Compression

Source: Archiving and Compression: tar, gzip, zip

47. Archiving and compression are two different jobs. Which one does tar do on its own, and what does the -z flag actually add?

48. Why is extracting an untrusted archive as root more dangerous than as a normal user? Name the specific tar behavior that makes it dangerous, and the inspection step you run first.

49. What problem does rsync solve that tar does not? Explain the trailing-slash difference between rsync -a project/ dest/ and rsync -a project dest/, and why --delete should always be tested with -n first.

50. A backup script archives a directory and then deletes the originals. Which verification steps must run between those two actions, and what real failure does skipping them cause?

04. The Linux Filesystem Model

Disk and File System Basics

Source: Disk and File System Basics

51. Walk the storage stack from a physical disk down to /var/log/app.log. Define disk, block device, partition, volume, file system, mount, and mount point, and say where LVM, RAID, and LUKS each insert themselves.

52. df and du report different numbers for the same directory. Name at least four legitimate reasons for that, and explain why they are answers to two different questions rather than two measurements of the same thing.

53. An application reports No space left on device, but df -h shows plenty of free space. What is the other capacity you must check, which command shows it, and what kind of workload exhausts it?

54. df says the file system is full, but du cannot find the space. Explain the mechanism, the command that proves it (and what NLINK 0 means in that output), the safe fix, and why truncating through /proc/<pid>/fd/<n> is the last resort rather than the first.

55. Explain LVM's physical volume, volume group, and logical volume. A mounted volume needs to grow with no downtime — give the exact two-step sequence, and say what a candidate has missed if they name only one step.

56. Compare ext4 and XFS on journaling scope, shrinking, growing, and repair tooling. You are asked to shrink an existing XFS file system — what is your answer, and how do you confirm the file system type first?

Linux Filesystem Hierarchy

Source: Linux Filesystem Hierarchy

57. Distinguish /, the root account, and /root. Why is an absolute path only absolute relative to the tree a given process sees?

58. Sort these by data lifecycle and owner: /etc, /usr, /var/lib, /var/cache, /run, /tmp, /var/tmp. For a new inventory-api service, where would its code, configuration, persistent state, runtime socket, and logs each go, and why?

59. On a current Ubuntu server, ls -ld /bin shows a symbolic link. What is usr-merge, why does #!/bin/sh still work, and what must a script never assume about these paths?

60. What is /usr/local for, and how does it differ from /usr and /opt? What goes wrong when you hand-edit a package-managed file under /usr, and how do you find which package owns a path on Debian/Ubuntu and on the RHEL family?

61. Why can /proc and /sys not be treated as ordinary disk directories? Give an example of writing to one of them changing live kernel behavior, and say why du output under them is meaningless.

Paths and File Types

Source: Paths and File Types

62. Describe how the kernel resolves /etc/ssh/sshd_config one component at a time. No such file or directory can have at least four distinct causes — name them, and say which command distinguishes them.

63. What is the difference between pwd and pwd -P? When do realpath -L and realpath -P disagree, and what does -e add over -m?

64. What does namei -l show that ls -l on the final file cannot? What does namei -lx mark with an uppercase D, and why does that matter on a server with bind mounts or containers?

65. Name the seven object types shown by the first character of ls -l. In crw-rw-rw- 1 root root 1, 3 ... /dev/null, what is 1, 3 — and what does each of ls, stat, and file actually tell you?

66. Why is ~ in a systemd unit or a YAML config file a bug waiting to happen, while ~ in an interactive shell works fine? What performs the expansion, and what does printf '%s\n' "~" output?

Hard and Symbolic Links

Source: Hard and Symbolic Links

67. Describe a hard link and a symbolic link in terms of the directory entry, the inode, and what is stored on disk. Which of the two has its own inode, and which one has no "original"?

68. A symlink stores the relative target releases/v2. Relative to what is that resolved — the link's own directory, or the shell's current directory? What does ln -sr do, and when do you choose an absolute target instead?

69. You have a dangling symlink. Explain the different answers you get from ls -l, readlink, realpath -e, test -L, and test -e, and which test a script should use to ask "does this link exist?"

70. A hard link fails with Invalid cross-device link. Explain why the restriction exists, and which two commands prove that two paths are on different file systems even when they look like the same disk.

71. A deployment switches /srv/myapp/current to a new release. Why is ln -s into a temporary name followed by mv -T safer than ln -sfn, what makes the rename atomic, and what does the swap not update for an already-running process?

Mounting File Systems

Source: Mounting File Systems

72. What are the four parts of a mount? List the kinds of source a mount can have, and explain how a bind mount differs from a symbolic link.

73. A directory already contained files before something was mounted on top of it. What happens to those files, and why is a non-empty mount point a production risk when the mount fails to come up at boot?

74. findmnt -T, mountpoint, and lsblk — which question does each answer? Which mounts appear in findmnt but never in lsblk, and why?

75. Why should /etc/fstab use UUID= instead of /dev/sdb1? Name the six fstab fields, and describe how you validate a change without risking a server that will not boot.

76. When does fsck run automatically, and what are the two independent triggers on an ext4 file system? What do -n, -f, and -y do, and why must you never run it against a mounted read-write file system?

77. umount returns target is busy. Walk through your diagnosis in order, and explain why umount -l is not the fix.

78. A container and its host both show /srv/data, but the contents differ. Explain mount namespaces, and which file you read to compare what a specific PID actually sees.

05. Users, Groups, and Permissions

Users and Groups

Source: Users and Groups

79. Name the seven fields of a /etc/passwd line. Why is the second field an x, and why is getent passwd a better check than grep /etc/passwd?

80. What is the difference between a primary and a supplementary group? Which one decides a newly created file's group, and why does adding a user to a group not take effect in their already-open shell?

81. How does a system (service) account differ from a human one? Which file defines the UID boundary, what does useradd -r do, and why is /usr/sbin/nologin the right shell for a daemon?

82. Why is usermod -aG docker alice correct and usermod -G docker alice dangerous? What exactly can that mistake take away, and how do you verify before and after?

83. A user reports "I can't log in." Using chage -l, how do you tell a password expiry from an account expiry, and why does the fix differ between the two?

84. userdel versus userdel -r: what is left behind, and what is the concrete risk once that UID gets reassigned to a new account? What do you audit before deleting?

File Permissions (rwx)

Source: File Permissions (rwx)

85. Walk through the kernel's decision chain when a process opens /srv/app/config.ini. Why does the kernel never add the owner, group, and other bits together, and what happens when the owning process has less access than other?

86. On a directory, what do r, w, and x each actually permit? Give the observable difference between a directory at 0400 and one at 0100.

87. A file is mode 0000 and you still deleted it. Explain which object's permissions actually governed that, and what would have changed if the parent directory carried a sticky bit.

88. A script has its execute bit set but still will not run. Name at least three causes outside the permission string, and the error message each one produces.

89. Explain the difference between find -perm 0644, find -perm -0640, and find -perm /0022. Which form fits a "find anything group- or other-writable" audit, and what does find -perm not account for?

90. A service running as www-data gets Permission denied on a file whose own mode looks correct. Describe your diagnosis in order — which commands, in which sequence — and how you test the access as the service account without printing the file's contents.

Ownership

Source: Ownership

91. Ownership is stored as what, exactly, in the inode? Why can restoring a backup on a different host silently produce wrong ownership, and which command shows the raw values instead of names?

92. Explain what each of chown ali file, chown ali:developers file, chown :developers file, and chown ali: file does. What do --reference and --from add, and why does exit status 0 not prove everything changed?

93. How does chown behave on a symlink by default, and what does -h change? Why is a recursive chown that follows symlinks dangerous on a tree an untrusted user can write to?

94. Changing a file's owner can silently clear two security-relevant attributes. Which ones, and what do you check before and after running chown on a privileged executable?

95. Does ownership survive cp, cp -a, and mv? Explain the difference and what determines a new file's owner in each case.

Special Permissions (SUID, SGID, Sticky)

Source: Special Permissions

96. The special bits occupy a fourth octal digit. What are 4, 2, and 1, and what do 4755, 2770, and 1777 mean? What do a lowercase s and an uppercase S in ls -l tell you apart?

97. How does setuid change a process at execve time — which of the real and effective UID is replaced? Name the situations in which Linux ignores the setuid bit entirely.

98. Why does chmod u+s on a shell script not give it root? What should you use instead for a genuinely privileged task?

99. setgid on an executable and setgid on a directory do two completely different things. Explain both, and say why a setgid directory alone does not make new files group-writable.

100. What exactly does the sticky bit restrict on /tmp, and what does it not protect? Name four red flags when an audit turns up a setuid binary you did not expect.

umask

Source: umask

101. What base permissions do a regular file and a directory start from, and why does the file base contain no execute bit at all?

102. Why is umask a bitwise AND NOT rather than a subtraction? Show the difference using umask 0023 on a file, and give the wrong answer that the "subtraction" model produces.

103. Why does umask 0111 leave a new regular file unchanged while changing a new directory? Work it out at the bit level.

104. A shared setgid directory produces files in the right group but not group-writable. Which setting is actually responsible, and what is the fix?

105. Where can a umask come from — name every layer. Why does grep UMASK /etc/login.defs not prove the effective value, and how do you set and verify it for a systemd service?

Root and sudo

Source: Root and sudo

106. What actually makes a process "root" to the kernel? How do you audit a system for unexpected UID 0 accounts, and why is the # in a prompt not evidence?

107. Compare su, su --login, sudo, sudo -i, sudo -s, and sudo -u. Whose password does each typically require, and why is sudo su - usually a redundant layer?

108. sudo printf 'x' > /etc/app/app.conf fails with Permission denied. Explain exactly why, and give two safer ways to write that file with elevated privilege.

109. Read this rule aloud and explain every field: deploy ALL=(root) /usr/bin/systemctl reload catalog.service. What does ALL refer to in that position, and what does NOPASSWD give away?

110. Why is "the rule allows only one binary" not the same as least privilege? Give three ways a single permitted command can still lead to arbitrary root action.

111. Why must /etc/sudoers be edited with visudo rather than a plain editor? How do you validate a candidate drop-in before installing it, and what is your recovery plan if a broken rule locks sudo out?

112. Explain a PAM stack: the four types, and the difference between required, requisite, and sufficient control flags. Why does required deliberately keep evaluating after a failure?

113. "How do you stop SSH brute-force at the OS level?" Name the two complementary mechanisms, what each one keys on, and the attack each one alone fails to stop.

Permission Security

Source: Permission Security

114. Why is chmod 777 almost never the correct fix? State a least-privilege policy in its four parts, and map r, w, and x onto confidentiality, integrity, and availability.

115. Why should a service not own its own executable and configuration? Sketch the ownership and mode split for a service's code, config, secret, runtime data, and uploads, and say what a compromised process gains if you get it wrong.

116. Write the read-only find audits for: world-writable files, files that are both writable and executable, world-writable directories with no sticky bit, and objects with no resolvable owner. Why must you never bolt -exec chmod onto the results?

117. ls -l shows a trailing +. What does that mean, what does the ACL mask do to a named-user entry, and how do you grant exactly one extra account read access without touching the owner, group, or mode?

118. What is a default ACL, how does it differ from an ordinary one, and which problem does it solve that setgid alone cannot?

119. DAC permissions look correct and the service still gets Permission denied. Name the additional layers that can deny it, the read-only command that surfaces each, and why setenforce 0 or leaving an AppArmor profile in complain mode is not a fix.

06. Processes and System Resources

Programs and Processes

Source: Dasturlar va processlar

120. What is the difference between a program and a process? List what the kernel tracks per process, and explain why apt upgrade replacing a binary does not change what an already-running service is executing.

121. Explain fork() and execve() and what each one does to the PID and the address space. Why is fork() described as cheap when it appears to duplicate an entire address space?

122. What is the difference between a process and a thread on Linux? Explain it in terms of clone() flags, the TGID/TID distinction, and the practical trade-off between isolation and cheap communication.

123. Read these ps STAT codes: R, S, D, T, Z, and the suffixes s, l, and +. Which of them tells you a process is blocked on I/O rather than waiting for input, and why does that difference matter when something looks "stuck"?

124. You kill a supervising process and expect its children to die with it. What actually happens to them, how would you verify it, and what is the correct way to stop the whole tree?

Process Monitoring

Source: Processlarni kuzatish

125. What does a load average of 4.15, 2.03, 0.98 actually measure, and which command must you run before you can judge whether it is high? What does the ordering of the three numbers tell you?

126. Load average is high but %Cpu(s) shows low us and sy. Which field do you read next, what does that state mean, and which tools do you reach for after it?

127. Explain each field of %Cpu(s): us, sy, ni, id, wa, hi, si, st. What does a persistently nonzero st mean on a cloud VM, and is it something you can fix inside the guest?

128. You are told a single multi-threaded java process is burning CPU. Which top invocation shows you the specific thread responsible, and what other command gives the same view?

Process Memory

Source: Process xotirasi

129. What is the difference between VSZ and RSS? Name three things that inflate VSZ without consuming physical RAM, and explain demand paging.

130. Why does summing RSS across ten nginx workers overstate real memory usage? Define PSS and USS, and say which one answers "how much would actually be freed if I killed this one process?"

131. A server shows 411Mi free out of 15Gi. Is it about to run out of memory? Explain buff/cache and which column in free -h is the real answer.

132. A system has 90% of its swap used. Is that a problem by itself? Which two vmstat fields distinguish "cold pages parked once" from active thrashing?

133. How does the OOM killer choose its victim? What does oom_score_adj = -1000 protect, what does it not protect, and where do you find the definitive record of a kill that already happened?

Process Priority

Source: Process prioriteti

134. What range do nice values span, and what does raising one actually do? Why does a process at nice 19 still consume 100% of a core on an otherwise idle system, and what is the correct tool if you want a real CPU cap?

135. Why can an unprivileged user raise their own process's nice value but never lower it back? What is the difference between nice and renice, and what do renice -u and -g target?

136. How does real-time scheduling (SCHED_FIFO/SCHED_RR) differ from a very negative nice value? Explain concretely why chrt -f -p 99 on a service with an unbounded loop is more dangerous than renice -n -20 on the same service.

137. A nightly backup makes the web server slow, and top shows elevated wa. Why will renice alone not fix this, which tool addresses the other axis, and what is the single command that launches the job correctly from the start?

Signals and Process Control

Source: Signallar va process boshqaruvi

138. What is a signal, and what are the three possible dispositions a process can have for one? Which two signals can never be caught, ignored, or handled, and why is that a deliberate design guarantee?

139. Explain the operational difference between SIGTERM and SIGKILL. Give three concrete kinds of damage that kill -9 as a first instinct can cause, and write the standard escalation pattern.

140. What is SIGHUP historically, and what do daemons commonly repurpose it for? What must you run before sending it to nginx, and why is systemctl reload preferable when the service is systemd-managed?

141. What is a zombie process, why does sending it SIGKILL do nothing, and what actually resolves a growing zombie count?

142. systemctl stop times out and the process is still there with STAT of D. Explain why no signal — not even SIGKILL — will terminate it, how you confirm what it is blocked on, and where the real fix lies.

Foreground and Background Jobs

Source: Foreground va background jobs

143. "My backup script died when I closed my SSH session, even though I started it with &." Explain precisely what & does and does not detach the process from, and name the mechanisms that actually provide survival across a disconnect.

144. Explain the Ctrl+Z → bg → fg sequence, naming the signal each step sends. What problem does it solve that killing and restarting the command does not?

145. What is the difference between a job number (%1) and a PID? Why does kill %1 work while kill 1 is a completely different and dangerous command?

146. Using PGID and TPGID from ps, explain why Ctrl+C has no effect on a job you moved to the background. When would you use nohup, disown, tmux, and a systemd unit respectively?

The /proc Filesystem

Source: /proc fayl tizimi

147. Why does ls -l report size 0 for most files under /proc? Explain what a pseudo-filesystem is and where ps, top, and lsof actually get their numbers from.

148. Name what /proc/<pid>/cmdline, cwd, exe, fd, limits, and status each tell you. Why does cmdline separate arguments with NUL bytes, and how do you confirm which binary a running process is actually executing after a package upgrade?

149. df shows a filesystem nearly full but du cannot account for the space. Write the /proc-based command that finds the culprit, explain what the (deleted) marker means, and give the correct fix — plus the underlying practice that prevents a repeat.

07. Packages and Software Management

Package Management Basics

Source: Paketlarni boshqarish asoslari

150. What separates a package from a plain .tar.gz archive? Name the three concrete costs of building from source on a production server, and say which question a package manager can answer that manual extraction never can.

151. What is a dependency, and what is "dependency hell"? Which layer of tooling exists specifically to solve it?

152. Describe the two-layer package management model. Which tool sits at each layer in the Debian and RHEL families, and what is the one thing the low-level tool deliberately does not do?

153. Why does dpkg -i fail with a missing-dependency error on a package that apt install handles cleanly? Answer in terms of the layer split, not the specific package.

154. What is a repository, and what two distinct things does your system request from it? Why does apt search return instantly without any network traffic?

apt and Repositories

Source: apt va repozitoriylar

155. What is the difference between apt and apt-get/apt-cache? Which should a script use, and why does that choice matter?

156. Explain the difference between apt update, apt upgrade, and apt full-upgrade. Which of them installs nothing, and why do some packages show up as "kept back"?

157. What is the difference between apt remove and apt purge? Which one is irreversible, and what would you do before running it on a server with a hand-tuned /etc/nginx/nginx.conf?

158. Walk through adding a third-party repository safely, step by step. Why is apt-key add deprecated, and what specific security problem does Signed-By solve?

159. Read apt-cache policy nginx output: what do Installed, Candidate, and the 500 priority number mean? How do you install one specific listed version, and how do you make that preference persistent?

160. What does apt-mark hold do, and what is the operational danger of forgetting one? Which command lists current holds?

dpkg and Dependencies

Source: dpkg va bog'liqliklar

161. Interpret these dpkg -l status codes: ii, rc, iU, iF. Which one means the package was removed but its configuration remains, and which signals an interrupted install?

162. Which command answers "which package installed this file?" and which answers the reverse? How do you inspect what a .deb file contains before installing it?

163. You installed a manually downloaded .deb with dpkg -i and got a dependency error. Explain why this is expected behavior rather than a bug, and give the standard one-command fix.

164. What is /var/lib/dpkg/status, and what is the one rule about it you must never break?

165. Why is dpkg -i --force-depends almost always the wrong fix on a production server? What actually happens to the package and to the software's behavior?

Snap Packages

Source: Snap paketlari

166. How does a snap solve the dependency problem differently from a .deb? Name both sides of that trade-off concretely.

167. Explain strict, classic, and devmode confinement. Why does a classic snap from an untrusted publisher carry roughly the same risk as an unverified .deb?

168. What are snap channels, and which one belongs on a production server? What does snap revert give you that apt does not provide out of the box?

169. What is the default snap update behavior, and why is it a production concern? Which command shows the next scheduled refresh, and how do you constrain the window?

170. A team asks whether to install a tool via Snap or apt. Give the decision rule, and name what the Snap choice costs them operationally.

Production Updates

Source: Production'da yangilanishlar

171. What is the difference between a security update and an ordinary version update, and why are they handled with different urgency? How do you tell which stream a pending upgrade came from?

172. What does unattended-upgrades do, which origins does it allow by default, and why is Automatic-Reboot "true" a setting to think twice about on a production server?

173. Which two files tell you a reboot is required and which package caused it? How do you schedule the reboot rather than performing it immediately, and how do you cancel it?

174. After an openssl upgrade the service looks fine but may still be running vulnerable code. Explain why, name the tool that detects this, and say what it actually inspects to find out.

175. Why is a major release upgrade not just a bigger apt full-upgrade? Name the tool, and list the preparations that must be in place before running it on production.

176. Describe the weekly production update check as an ordered sequence of commands, and explain why the order matters — specifically why the last two steps cannot be skipped.

RPM, YUM, and DNF

Source: RPM, YUM va DNF (RHEL oilasi)

177. Map these Debian commands onto their RHEL-family equivalents: apt search, apt install, apt update, apt upgrade, dpkg -s, dpkg -L, dpkg -S. Where do repository definitions live on each side?

178. What does dnf history undo <id> do, and why is it a genuine capability apt does not build in? Does it replace a backup before a major upgrade?

179. What does gpgcheck=0 in a .repo file disable, and what is the Debian-side equivalent mistake? Why is "temporarily, just for testing" a common route to a production security hole?

08. Boot, Kernel, and systemd

The Boot Process and GRUB

Source: Boot jarayoni va GRUB

180. Name the five boot stages in order, from power-on to PID 1, and say what each one hands to the next. What is initramfs actually for, and when would a system fail without it?

181. Which three GRUB files matter, what is each one's role, and which of them must never be edited by hand? What command regenerates the generated one?

182. How do you add a kernel parameter for a single boot only, and how do you make one permanent? What is the difference between GRUB_CMDLINE_LINUX and GRUB_CMDLINE_LINUX_DEFAULT?

183. Why does the generated linux line mount the root filesystem ro, and what consequence does that have for recovery work later?

184. "The server won't boot — where do you start?" Match these symptoms to a stage: nothing on screen at all; GRUB menu appears then hangs; "Gave up waiting for root device"; kernel messages scroll then systemd reports failures. Why is journalctl the wrong first tool for some of them?

Kernel Modules

Source: Kernel modullari

185. What is a kernel module, why are modules stored under a directory tied to the exact kernel version, and what does the Used by column in lsmod tell you?

186. What is the difference between modprobe and insmod, and between modprobe -r and rmmod? Which do you use by default and why?

187. How do you make a module load on every boot, and how do you pass it a persistent parameter? Why does modprobe <mod> param=value sometimes appear to do nothing?

188. You blacklisted a driver but it still loads at boot. Give both reasons this happens, the extra command required, and the precaution to take before blacklisting a network or video driver on a remote server.

init and systemd

Source: init va systemd

189. What are PID 1's two responsibilities, and what happens to the system if PID 1 dies? Why is kill -9 1 not an ordinary process operation?

190. Explain reaping, orphans, and zombies in terms of PID 1's job. Why do zombies pile up inside a container with a badly chosen entrypoint, and what is the standard fix?

191. How did SysV init's runlevel model work, and what were its three structural weaknesses? Name the systemd feature that addresses each one.

192. What is the difference between systemd and systemctl? Name at least four commands in the systemd tool family and what each manages.

systemd Units and Targets

Source: systemd unitlari va targetlari

193. What is a unit? Name at least five unit types and what each represents. In systemctl list-units output, what do LOAD, ACTIVE, and SUB mean?

194. Name the three unit file directories and their priority order. Why is systemctl cat <unit> a more reliable way to find the active configuration than searching with find?

195. What is a drop-in, and why is copying a vendor unit into /etc/systemd/system/ a maintenance trap? What is special about overriding ExecStart= in a drop-in?

196. Distinguish Wants=, Requires=, After=, and Before= across the two dimensions they cover. Why are Wants=network-online.target and After=network-online.target almost always written together?

197. What is a target, and which targets correspond to the old runlevels 0, 1, 3, 5, and 6? Why does a target never start a process itself?

198. What is the difference between systemctl get-default/set-default and systemctl isolate? What is the specific danger of running isolate on a server you are connected to over SSH?

Service Management

Source: Xizmatlarni boshqarish

199. What is the difference between restart and reload, and why does the distinction matter on a high-traffic production service? What does reload-or-restart solve?

200. start/stop and enable/disable are two independent dimensions. Name the four possible combinations, what enable actually creates on disk, and what enable --now does.

201. Read a systemctl status block: what do Loaded, Active, Main PID, and CGroup each tell you? Which one shows every process belonging to the service?

202. Which three commands give exit-code-friendly status checks for a script, and what does each return? Write the conditional form you would use in a health-check script.

203. What is the difference between disable and mask? Give a concrete case where disable is not enough, and explain what mask does on disk.

Creating a Custom systemd Service

Source: O'z systemd xizmatini yaratish

204. Explain Type=simple, forking, oneshot, and notify. What goes wrong if you set Type=simple on a program that forks, and which type do most Python/Node/Go backends use?

205. Why must daemon-reload run after creating or editing a unit file? What is the observable symptom of forgetting it?

206. What is the difference between Restart=on-failure and Restart=always? What does RestartSec= control, and how would you prove the policy actually works?

207. A service with Restart=always is stuck in failed and will not come back. Explain the mechanism, name the two directives that control it, and give the correct recovery sequence — and why raising the limit is the wrong fix.

208. Name three common mistakes in a hand-written unit file: relative paths, missing User=, and a missing [Install] section. What error does each produce, and what does enable actually need [Install] for?

Deploying a Backend App as a Service

Source: Backend ilovani xizmat sifatida

209. Why create a dedicated --system --no-create-home --shell /usr/sbin/nologin user for an application? What does each of those three flags accomplish?

210. What does EnvironmentFile= give you that putting values directly in the unit does not? Which command must run after changing the unit, and which after changing only the environment file?

211. Explain NoNewPrivileges=, ProtectSystem=strict, ProtectHome=, and ReadWritePaths=. What failure appears if you enable ProtectSystem=strict and forget ReadWritePaths=?

212. A service running as an unprivileged user needs to bind port 443. Give the systemd-native answer and at least one alternative, and explain why simply removing User= is the wrong solution.

journalctl

Source: journalctl

213. How does systemd-journald differ from a plain-text log file like /var/log/syslog? What does the structured format let you do that grep over a flat file cannot?

214. Write the journalctl filters for: one unit, live follow, the current boot, the previous boot, a time window, and errors only. What does -p err actually include?

215. What does journalctl -xeu <unit> do, field by field, and why is it the reflex command after a failed start? What does journalctl -k add to the picture?

216. A server rebooted unexpectedly last night and your logs are gone. Explain the default journal storage behavior, how to make it persistent, and how you verify persistence worked.

217. How do you check the journal's disk usage and cap it? Give both the one-off commands and the standing configuration setting.

systemd Troubleshooting

Source: systemd troubleshooting

218. Describe the diagnostic sequence for a failing service, from first command to fix. Which command gives the system-wide overview, and which one usually contains the actual cause?

219. In systemctl status, what is the difference between Result: exit-code and Result: signal? Why do those two point to entirely different investigations?

220. Decode these systemd exec statuses: 203/EXEC, 200/CHDIR, 217/USER, 226/NAMESPACE. Which unit directive is wrong in each case?

221. A process shows killed with status=9/KILL and nobody killed it by hand. What is the likely cause, and which command confirms it?

222. What is the difference between systemd-analyze blame and systemd-analyze critical-chain? Why can the unit at the top of blame be innocent?

Rescue and Emergency Mode

Source: Rescue va emergency mode

223. Compare rescue.target and emergency.target on filesystems, services started, and typical use. Why does emergency.target still work when rescue.target cannot start?

224. How do you enter either mode through GRUB, and how long does that change last? What is the systemd equivalent of the old single/1 parameter?

225. rescue.target prompts for the root password — which is exactly what you forgot. Give the Ubuntu/Debian bypass and the RHEL-family one, including the extra step SELinux requires, and say why that shell must not be used for general repair work.

226. A bad /etc/fstab line dropped the server into emergency mode. Walk through the recovery from entering the mode to a clean reboot, and name the step people most often forget — plus the command that prevents a second failed boot.

Time Zone and Locale Settings

Source: Vaqt zonasi va locale sozlamalari

227. Read timedatectl output: what do Time zone, System clock synchronized, and NTP service tell you? Why do production fleets standardize on UTC rather than local time?

228. System clock synchronized: no — why is that worth acting on? Name at least three things that break with an incorrect clock, and what you check first.

229. Explain the relationship between LANG, the individual LC_* variables, LC_ALL, and what localectl set-locale sets. Why do scripts that parse dates or numbers run with LC_ALL=C?

References

• GNU Bash Reference Manual: https://www.gnu.org/software/bash/manual/bash.html
• GNU Coreutils manual: https://www.gnu.org/software/coreutils/manual/coreutils.html
• GNU Findutils manual: https://www.gnu.org/software/findutils/manual/html_node/find_html/index.html
• GNU Grep manual: https://www.gnu.org/software/grep/manual/grep.html
• GNU sed manual: https://www.gnu.org/software/sed/manual/sed.html
• GNU Awk User's Guide: https://www.gnu.org/software/gawk/manual/gawk.html
• GNU tar manual: https://www.gnu.org/software/tar/manual/tar.html
• Filesystem Hierarchy Standard 3.0: https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html
• Linux man-pages: path_resolution(7): https://man7.org/linux/man-pages/man7/path_resolution.7.html
• Linux man-pages: inode(7): https://man7.org/linux/man-pages/man7/inode.7.html
• util-linux: findmnt(8), lsblk(8), namei(1): https://man7.org/linux/man-pages/man8/findmnt.8.html
• Linux man-pages: fstab(5): https://man7.org/linux/man-pages/man5/fstab.5.html
• Linux man-pages: credentials(7) and capabilities(7): https://man7.org/linux/man-pages/man7/credentials.7.html
• Linux man-pages: acl(5), setfacl(1), getfacl(1): https://man7.org/linux/man-pages/man5/acl.5.html
• Sudo manual: sudoers(5): https://www.sudo.ws/docs/man/sudoers.man/
• Linux-PAM System Administrators' Guide: https://www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html
• Linux manual pages project: https://man7.org/linux/man-pages/