CTLA flashcards
CTLA · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- umask 022 result
- Files are created 0644 and directories 0755, because the umask is subtracted from base modes 0666 and 0777 respectively.
- Sticky bit purpose
- On a directory such as /tmp, the sticky bit restricts deletion so only a file's owner, the directory owner, or root may remove entries.
- /etc/shadow contents
- Stores hashed passwords and aging data, readable only by root. Field two is the hash, and later fields set minimum age, maximum age, and warning days.
- journalctl persistent logs
- By default journald keeps logs in memory under /run. Creating /var/log/journal enables persistent storage across reboots, queried with journalctl -b for the current boot.
- set -o pipefail
- Makes a pipeline return the rightmost nonzero exit status instead of only the last command's status, so failures in earlier stages are detected.
- Double vs single quotes
- Double quotes permit variable expansion and command substitution but stop word splitting; single quotes treat every character literally with no expansion.
- find -mtime +7
- Matches files whose modification time is more than seven 24-hour periods ago. The plus means older than; a minus means newer than.
- 2>&1 ordering
- Duplicates stderr onto whatever stdout currently points to. Placing it after > file sends both streams to the file; placing it before sends stderr to the old target.
- grep -v and -c
- -v inverts the match and prints lines that do not contain the pattern; -c suppresses output and prints only the count of matching lines.
- RFC 1918 private ranges
- 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are non-routable on the public internet and are used inside private networks behind NAT.
- TCP three-way handshake
- The client sends SYN, the server replies SYN-ACK, and the client sends ACK. This establishes sequence numbers and a reliable bidirectional connection before data flows.
- 169.254.0.0/16 meaning
- The link-local APIPA range. A host self-assigns an address here when DHCP fails, indicating it has no routable address or working DHCP server.
- ss -tulpn
- Lists listening sockets: TCP and UDP, showing the numeric port, and with -p the owning process. It is the modern replacement for netstat.
- /etc/resolv.conf role
- Lists DNS nameserver addresses and search domains used by the resolver. Its order of lookup relative to files and DNS is set in /etc/nsswitch.conf.
- SELinux enforcing vs permissive
- Enforcing blocks and logs policy violations; permissive only logs them. Switching to permissive is for diagnosis, and disabling removes all mandatory access control.
- PermitRootLogin no
- An sshd_config directive that blocks direct root logins over SSH, forcing administrators to log in as themselves and escalate with sudo for accountability.
- visudo purpose
- Safely edits /etc/sudoers with syntax checking and file locking, preventing a malformed rule from locking all users out of privilege escalation.
- auditd watch rule
- auditctl -w /etc/passwd -p wa logs writes and attribute changes to that path, recording events in /var/log/audit/audit.log for later review.
- GPT versus MBR
- GPT supports disks larger than 2 TiB and up to 128 partitions by default with a backup header; MBR is limited to 2 TiB and four primary partitions.
- LVM extend sequence
- Grow the logical volume with lvextend, then grow the filesystem: resize2fs for ext4 or xfs_growfs for XFS. The filesystem step is separate and required.
- XFS shrink limitation
- XFS filesystems cannot be shrunk; they can only be grown online. Reducing an XFS volume requires backing up, recreating, and restoring the data.
- Incremental vs differential backup
- Incremental copies changes since the last backup of any type; differential copies changes since the last full. Restoring an incremental chain needs every increment in order.
- df -i purpose
- Reports inode usage per filesystem. A full filesystem that still shows free space in df -h is often out of inodes from many small files.
- SIGTERM versus SIGKILL
- SIGTERM (15) asks a process to shut down gracefully and can be caught; SIGKILL (9) cannot be caught or ignored and should be used only as a last resort.
- systemctl enable versus start
- Enable creates the symlink so the unit starts at boot; start launches it only in the current runtime. Enabling does not start a unit immediately.
- Zombie process state
- A process in state Z has exited but its parent has not called wait to reap it. Zombies consume no CPU and are cleared when the parent exits or reaps.
- nice value range
- Values run from -20, highest scheduling priority, to 19, lowest. Only root may assign negative values; renice adjusts a running process.
- Type 1 versus Type 2 hypervisor
- Type 1 runs directly on bare metal, such as KVM or ESXi; Type 2 runs as an application on a host operating system, such as VirtualBox.
- Security group versus network ACL
- Security groups are stateful, instance-level, and allow-only. Network ACLs are stateless, subnet-level, support deny rules, and evaluate in numbered order.
- virtio driver benefit
- Paravirtualized virtio devices expose a hypervisor-aware interface instead of emulated hardware, cutting I/O overhead and raising throughput for disks and network.
- Emergency mode boot cause
- The system usually drops to emergency mode when an /etc/fstab entry cannot be mounted. Correct the fstab entry or boot with rd.break to repair it.
- lsof +L1
- Lists open files with a link count below one, revealing deleted files still held open by a process. Space is reclaimed only when the process closes them.