Problems

Labs open a real Linux machine in your browser. Quizzes check the theory in a minute.

92 of 277 problems

Title	Topic	Acceptance	Difficulty	XP
Restore One File from a Backup ArchivePull a single member out of a compressed tarball without unpacking the rest.easyLinux10 XP	Linux	New	easy	10
Set an Exact File ModeA key file is world-writable. Set its permission bits to an exact octal mode without touching ownership.easyLinux10 XP	Linux	New	easy	10
Fix "Permission denied" on Service DataA service account cannot write its own data directory. Find the real cause and fix it without loosening permissions.easyLinux10 XP	Linux	New	easy	10
Shared Team Directory with setgid and stickyBuild a team drop box where new files inherit the group and members can only delete their own files.mediumLinux20 XP	Linux	New	medium	20
Grant One Extra User Access with ACLsGive a single auditor read access to a report without changing its owner, group or mode bits.mediumLinux20 XP	Linux	New	medium	20
Create a User AccountAdd an account with a specific shell, home directory, primary group, secondary groups and a locked password.easyLinux10 XP	Linux	New	easy	10
Grant Exactly One Command via sudoLet an operator restart one service as root without a password and without handing over a root shell.mediumLinux20 XP	Linux	New	medium	20
Set Up SSH Key AuthenticationGenerate an ed25519 key pair and authorize it for another account with the permissions sshd insists on.mediumLinux20 XP	Linux	New	medium	20
Stop a Process That Ignores SIGTERMIdentify a rogue process among look-alikes, record its PID, and stop it even though it ignores a normal kill.easyLinux10 XP	Linux	New	easy	10
Who Is Listening on That Port?Go from an open TCP port to the process that owns it and the program it was started from.mediumLinux20 XP	Linux	New	medium	20
Pin a Hostname with /etc/hostsMake a hostname resolve to a fixed IP address on this machine without touching DNS.easyLinux10 XP	Linux	New	easy	10
Robust fstab EntriesA data disk is mounted at /data via /dev/sdb1 /data xfs defaults 0 0 in /etc/fstab. After a reboot where the disk was missing, the server stopped in emergency mmediumLinux5 XP	Linux	New	medium	5
Activating Swap SpaceYou created partition /dev/vdb2 of type Linux swap and ran mkswap /dev/vdb2. free -h still shows 0B of swap. What is missing?easyLinux3 XP	Linux	New	easy	3
firewalld Runtime vs PermanentYou run firewall-cmd --permanent --zone=public --add-service=https. The command prints success, but clients still cannot reach port 443. Nginx is listening. WhaeasyLinux3 XP	Linux	New	easy	3
systemd Timers vs cronA backup must run daily at 02:00 on a VM that is often powered off overnight. If the run is missed, it should happen soon after the next boot. Which systemd timmediumLinux5 XP	Linux	New	medium	5
Booting into Rescue ModeAfter a bad change, a service hangs the boot. You have console access and the root password. How do you boot once into single-user rescue mode without changing mediumLinux5 XP	Linux	New	medium	5
Keeping Logs Across RebootsA server rebooted unexpectedly. journalctl --list-boots shows only the current boot, so the logs from before the crash are gone. journald.conf has the default SmediumLinux5 XP	Linux	New	medium	5
Filtering the JournalYou need only errors or worse from the SSH service in the last hour. Which command gives that?easyLinux3 XP	Linux	New	easy	3
Persistent Static IP with nmcliYou set a server's address with ip addr add 10.0.5.20/24 dev ens3. It works, but after a reboot the address is gone. The connection profile is named ens3. How dmediumLinux5 XP	Linux	New	medium	5
Root Password RecoveryTo reset a forgotten root password on RHEL, you boot with rd.break, run mount -o remount,rw /sysroot, chroot /sysroot and passwd root. Why is the next step touchardLinux8 XP	Linux	New	hard	8
Password Aging with chageNew user maria must change her password at first login, and from then on every 90 days. Which commands do this?easyLinux3 XP	Linux	New	easy	3
Rootless Podman at BootUser app runs a rootless Podman container as a systemd user service (a Quadlet .container file in ~/.config/containers/systemd/, enabled for default.target). IthardLinux8 XP	Linux	New	hard	8
Process Priority with niceA regular user starts a long compression job with nice -n 10 xz big.tar, then tries to speed it up with renice -n 0 -p <pid>. The command fails with Permission easyLinux3 XP	Linux	New	easy	3
Reading rwxr-x---ls -l shows -rwxr-x--- for a script. What is its octal mode?easyLinux3 XP	Linux	New	easy	3
SIGTERM vs SIGKILLWhat is the key difference between kill PID and kill -9 PID?easyLinux3 XP	Linux	New	easy	3
sudo and Redirectionsudo echo "net.ipv4.ipforward=1" > /etc/sysctl.d/99-fw.conf fails with "Permission denied". Why?mediumLinux5 XP	Linux	New	medium	5
Search and Replace Across Many FilesUpgrade every http:// endpoint to https:// in all config files of a tree, and only in config files.easyShell10 XP	Shell	New	easy	10
Top Talkers in an Access LogBuild a pipeline that finds the busiest client IPs in a web server log and formats the report exactly.mediumShell20 XP	Shell	New	medium	20
Filenames with Spaces in PipelinesYou need to delete all .tmp files under a directory; some names contain spaces and newlines. Which command is safe?hardShell8 XP	Shell	New	hard	8
Fix the Last Commit MessageCorrect a typo in the most recent, not-yet-pushed commit without creating a new commit.easyGit10 XP	Git	New	easy	10
Squash WIP Commits Before ReviewCombine several messy work-in-progress commits on a feature branch into one clean commit.hardGit40 XP	Git	New	hard	40
Pause Your Work for an Urgent HotfixShelve uncommitted changes, commit a hotfix cleanly, then get your work-in-progress back.mediumGit20 XP	Git	New	medium	20
Forks, Branches and ClonesYou want to fix a bug in an open-source project on GitHub. You have no write access to its repository. What is the usual way to contribute?easyGit3 XP	Git	New	easy	3
Issues vs Discussions vs ProjectsMaintainers of a popular library are overwhelmed by "how do I...?" questions and loose feature ideas opened as issues. They want a separate community space for easyGit3 XP	Git	New	easy	3
Linking Issues with ClosesA pull request into main (the default branch) has this description:easyGit3 XP	Git	New	easy	3
Fix a Service With No EndpointsA Service routes to nothing because its selector misses the Pods. Point it at exactly the right replicas without catching the canary.easyKubernetes10 XP	Kubernetes	New	easy	10
Add Readiness and Liveness ProbesGive a Deployment the health checks it is missing, so Kubernetes stops sending traffic to Pods that are not ready and restarts hung ones.mediumKubernetes20 XP	Kubernetes	New	medium	20
Run a StatefulSet Behind a Headless ServiceGive each replica of a clustered datastore a stable name and DNS identity with a StatefulSet and a headless Service.mediumKubernetes20 XP	Kubernetes	New	medium	20
Route a Host and Two PathsPublish a frontend and its API under one host name with an Ingress that sends each path to the right Service and port.mediumKubernetes20 XP	Kubernetes	New	medium	20
Give a ServiceAccount Read-Only AccessCreate a ServiceAccount that can watch Pods and Deployments in one namespace and nothing more.mediumKubernetes20 XP	Kubernetes	New	medium	20
Build a Cluster-Wide Read-Only RoleGive an auditor read access to nodes, volumes and Pods across the cluster, without Secrets and without any write access.hardKubernetes40 XP	Kubernetes	New	hard	40
Lock Down Database TrafficWrite a NetworkPolicy so only the API tier can reach the database, without cutting off anything else.mediumKubernetes20 XP	Kubernetes	New	medium	20
Zero-Trust Networking with Default DenyBlock all traffic in and out of a namespace, then allow exactly the flows the app needs, DNS included.hardKubernetes40 XP	Kubernetes	New	hard	40
Choose the Least Permissive NetworkPolicyFour candidate policies are on disk. Apply the one that allows exactly the required traffic and nothing more.mediumKubernetes20 XP	Kubernetes	New	medium	20
Migrate an Ingress to the Gateway APIReplace an Ingress with a Gateway that terminates TLS and an HTTPRoute that routes the same way.hardKubernetes40 XP	Kubernetes	New	hard	40
Enforce the Restricted Pod Security StandardTurn on restricted Pod Security enforcement for a namespace and harden a multi-container Deployment so it still runs.hardKubernetes40 XP	Kubernetes	New	hard	40
Unstick a Helm ReleaseEvery Helm upgrade fails with "another operation is in progress". Recover the release and finish the upgrade the team asked for.hardKubernetes40 XP	Kubernetes	New	hard	40
Sign a Certificate for a New UserTurn a new admin's key and certificate request into a signed client certificate through the Kubernetes API, then give them read access.hardKubernetes40 XP	Kubernetes	New	hard	40
Serve an App over HTTPS with IngressStore the provided certificate as a TLS Secret and publish the app over HTTPS on its host name with an Ingress.mediumKubernetes20 XP	Kubernetes	New	medium	20
A Claim Stuck in PendingAn app waits on a PersistentVolumeClaim that never binds. Bind it to the volume prepared for it and get the app running.mediumKubernetes20 XP	Kubernetes	New	medium	20
Names Stopped ResolvingAfter a default-deny egress policy went in, the app can't look up any Service by name. Let DNS through, and only DNS.mediumKubernetes20 XP	Kubernetes	New	medium	20
The Ingress Returns 404 and 503The shop's Ingress serves nothing it should. Find what doesn't match between the Ingress, its class and the Services, and fix it.mediumKubernetes20 XP	Kubernetes	New	medium	20
A ServiceAccount With Just Enough AccessAn app runs with the namespace's default ServiceAccount and an auto-mounted token. Give it its own account that can read one ConfigMap and nothing else, and keep the token off every other Pod.mediumKubernetes20 XP	Kubernetes	New	medium	20
Keep Pods Away From the Metadata ServicePods can reach the cloud's instance metadata endpoint and steal the node's credentials. Block it for every Pod in the namespace, without cutting off anything else.mediumKubernetes20 XP	Kubernetes	New	medium	20
Only Images From the Company RegistryWrite a ValidatingAdmissionPolicy that rejects Pods with images from anywhere but the company registry, in the namespaces that opt in.hardKubernetes40 XP	Kubernetes	New	hard	40
Secrets as Files, Not Environment VariablesAn app reads its database password from an environment variable, where it leaks into crash dumps and debug output. Move it to a read-only file only the app's user can read.easyKubernetes10 XP	Kubernetes	New	easy	10
Who Can Read the Production Secrets?Audit RBAC across the cluster to find the ServiceAccount that can read Secrets in the payments namespace without needing to, record it, and revoke exactly that access.mediumKubernetes20 XP	Kubernetes	New	medium	20
Pass the Security LinterThe deployment pipeline now runs kube-linter with a security profile, and your team's manifest fails it. Fix the manifest until the linter is clean, then deploy it.mediumKubernetes20 XP	Kubernetes	New	medium	20
StorageClass Reclaim PolicyA developer deleted a PVC that was dynamically provisioned by the fast-ssd StorageClass. The PV and the cloud disk behind it were deleted too. How do you stop tmediumKubernetes5 XP	Kubernetes	New	medium	5
Liveness vs ReadinessA Pod's readiness probe starts failing while its liveness probe keeps succeeding. What happens?mediumKubernetes5 XP	Kubernetes	New	medium	5
Gateway API RolesThe platform team runs a shared Gateway in the infra namespace. Your team wants /orders on that Gateway to reach your orders Service. Which resource do you creaeasyKubernetes3 XP	Kubernetes	New	easy	3
PersistentVolumeClaimsA PVC stays in Pending. The cluster has a default StorageClass with volumeBindingMode: WaitForFirstConsumer. What is the most likely explanation?mediumKubernetes5 XP	Kubernetes	New	medium	5
NetworkPolicy DefaultsA namespace has no NetworkPolicies. You then add one policy that selects Pods app=db and allows ingress only from Pods app=api. Which statement is correct (withhardKubernetes8 XP	Kubernetes	New	hard	8
Pod Security Restricted LevelNamespace payments has the label pod-security.kubernetes.io/enforce: restricted. A Pod is rejected with: seccompProfile (pod or container "api" must set securitmediumKubernetes5 XP	Kubernetes	New	medium	5
Pinning Images by DigestCI scans registry.example.com/api:1.8 with Trivy and it passes. Later someone pushes a different image under the same tag. How do you make sure Pods run exactlyeasyKubernetes3 XP	Kubernetes	New	easy	3
ValidatingAdmissionPolicy BindingYou create a ValidatingAdmissionPolicy with the CEL expression has(object.metadata.labels.team) that matches Deployments. kubectl apply succeeds, but DeploymenthardKubernetes8 XP	Kubernetes	New	hard	8
Runtime Threat DetectionAn attacker exploits a web app and spawns /bin/sh from inside the running process; no one runs kubectl exec. Which control is designed to detect this as it happmediumKubernetes5 XP	Kubernetes	New	medium	5
Picking the Right SignalA checkout request passes through six microservices and sometimes takes 4 seconds. Which telemetry signal shows which hop is spending the time?easyKubernetes3 XP	Kubernetes	New	easy	3
Where Subcharts Come FromChart.yaml lists a dependency on redis 19.x from a repository URL. helm install app . fails with "found in Chart.yaml, but missing in charts/ directory". What fmediumKubernetes5 XP	Kubernetes	New	medium	5
Another Operation Is in Progresshelm upgrade api ./chart fails with "another operation (install/upgrade/rollback) is in progress". helm history api shows the last revision as pending-upgrade fhardKubernetes8 XP	Kubernetes	New	hard	8
Least Privilege with IAMAn application on a virtual machine needs to read objects from one storage bucket. What is the recommended way to give it access?easyCloud3 XP	Cloud	New	easy	3
Well-Architected PillarsDuring a Well-Architected review, the team discusses deploying across multiple Availability Zones, testing recovery procedures, and having the system automaticaeasyCloud3 XP	Cloud	New	easy	3
Regions and Availability ZonesWhat is the main reason to spread application servers across multiple Availability Zones in one region?easyCloud3 XP	Cloud	New	easy	3
CloudTrail vs CloudWatch vs ConfigA bucket policy was removed last Tuesday and the security team asks: which IAM principal made the DeleteBucketPolicy call, from which IP address, and when? WhicmediumCloud5 XP	Cloud	New	medium	5
Choosing a Storage ClassYou store compliance logs that must be kept for 7 years and are almost never read. Retrieval can take hours. Which object storage class is the most cost-effectimediumCloud5 XP	Cloud	New	medium	5
When Serverless Functions FitWhich workload is the best fit for a serverless function service (like AWS Lambda)?mediumCloud5 XP	Cloud	New	medium	5
SQS vs SNS Fan-OutEvery OrderPlaced event must be processed by three independent services (billing, shipping, analytics). Each service must receive every event, process at its owhardCloud8 XP	Cloud	New	hard	8
Roles vs Users for AccessA partner's auditing tool runs in their own AWS account and needs read-only access to resources in yours. What is the recommended setup?mediumCloud5 XP	Cloud	New	medium	5
How Big Is a /24?How many IPv4 addresses does the block 10.0.1.0/24 contain?easyNetworking3 XP	Networking	New	easy	3
Provider Versions and the Lock FileThe configuration declares version = "~> 5.40" for the hashicorp/aws provider. The committed .terraform.lock.hcl records 5.42.0. Version 5.60.0 has since been rmediumTerraform5 XP	Terraform	New	medium	5
Using Module OutputsThe root module calls a child module with module "network" { source = "./modules/network" }. Inside it, the VPC is awsvpc.main. How does the root module get theeasyTerraform3 XP	Terraform	New	easy	3
Reading Data with Data SourcesInstead of hard-coding an AMI ID, you want Terraform to look up the latest Amazon Linux AMI at plan time and use its ID for an instance. What do you write?easyTerraform3 XP	Terraform	New	easy	3
fmt and validate in CIA CI job must fail if any .tf file in the repo is not in canonical style, without modifying the files. Which command fits?easyTerraform3 XP	Terraform	New	easy	3
Variables and OutputsIn a reusable Terraform module, how do callers pass values in, and how does the module expose values out?easyTerraform3 XP	Terraform	New	easy	3
Implicit vs Explicit DependenciesAn EC2 instance's user data script downloads a file from S3 at boot. The permission comes from an awsiamrolepolicy that nothing in the instance block referenceseasyTerraform3 XP	Terraform	New	easy	3
count vs for_eachhclmediumTerraform5 XP	Terraform	New	medium	5
Lifecycle Meta-ArgumentsChanging an argument on a load balancer's TLS certificate forces replacement. By default Terraform destroys the old certificate first, causing an outage while leasyTerraform3 XP	Terraform	New	easy	3
Importing Existing ResourcesAn S3 bucket acme-logs-prod was created by hand in the console. You want Terraform to manage it without recreating it, and you would like Terraform to draft themediumTerraform5 XP	Terraform	New	medium	5
Renaming with moved BlocksYou rename resource "awsinstance" "web" to resource "awsinstance" "app" for clarity. terraform plan now wants to destroy awsinstance.web and create awsinstance.hardTerraform8 XP	Terraform	New	hard	8
Forcing Replacement with -replaceThe configuration is unchanged, but the VM behind awsinstance.web is in a broken state and you want Terraform to destroy and recreate just that instance. Which mediumTerraform5 XP	Terraform	New	medium	5
Workspaces vs Separate ConfigurationsA team uses CLI workspaces dev and prod in the same backend and the same configuration. Security now requires that prod state and prod credentials be completelymediumTerraform5 XP	Terraform	New	medium	5
Sensitive Values and StateA database password is passed in through variable "dbpassword" { sensitive = true } and used as the password argument of an awsdbinstance. Which statement is trhardTerraform8 XP	Terraform	New	hard	8