Linux_Practical_Interview_101 250

Linux Practical Interview Questions (101-250)

Level 8: Storage

Filesystems

Q101: How do you use zfs snapshots?

What it is: A ZFS snapshot is a point-in-time view named with @, created with zfs snapshot, listed with zfs list -t snapshot, restored with zfs rollback, or turned into a writable clone with zfs clone.

Why it is used: Instant, cheap backups and quick rollback when an update or change goes wrong.

# Create snapshot
zfs snapshot pool1/data@snap1
# List
zfs list -t snapshot
# Rollback
zfs rollback pool1/data@snap1
# Clone
zfs clone pool1/data@snap1 pool1/clone

Interview talking point: “rollback discards everything newer than that snapshot, so it is destructive to later data, while clone branches the snapshot into a new writable dataset without touching the original.”

Q102: How do you use zfs?

What it is: ZFS pools are created with zpool create using a mirror layout and a force flag, filesystems are children like pool1/data, and per-dataset properties such as compression and quota are set with zfs set.

Why it is used: Get checksummed storage with built-in compression and quotas in one filesystem hierarchy.

# Install
apt install zfs-dkms zfsutils-linux

# Create pool
zpool create -f mirror pool1 /dev/sdb1 /dev/sdc1

# Create filesystem
zfs create pool1/data

# Set properties
zfs set compression=lz4 pool1/data
zfs set quota=10G pool1/data

Interview talking point: “In ZFS pools and filesystems are separate, zpool create builds storage and zfs create makes datasets on it, and properties like compression and quota apply per dataset rather than pool-wide.”

Q103: How do you use zfs encryption?

What it is: ZFS native encryption protects a dataset created with encryption=on and keyformat=passphrase. Keys are managed separately with zfs keyload and keyunload.

Why it is used: Keeps data at rest unreadable on NAS, backup, or shared storage pools while the dataset stays usable normally.

# Create encrypted
zfs create -o encryption=on -o keyformat=passphrase pool1/encrypted

# Load key
zfs keyload -a  # all
zfs keyload pool1/encrypted

# Unload
zfs keyunload pool1/encrypted

Interview talking point: “Encryption is fixed at dataset creation, and keyunload leaves the dataset unreadable until the passphrase is keyloaded again; keyload -a restores every key, which is the form you script for unattended storage hosts.”

Mounting and fstab

Q104: How do you configure autofs with LDAP?

What it is: Installing autofs-ldap and adding an indirect map line in /etc/auto.master where /home resolves entries from ldap.example.com:/home/& with the ampersand substituting the requested username, plus LDAP URI and base in /etc/ldap.conf.

Why it is used: Home directories served from LDAP so any client machine mounts the right share on login.

# Install
apt install autofs-ldap

/home ldap ldap.example.com:/home/&

# /etc/ldap.conf
uri ldap://ldap.example.com
base dc=example,dc=com

Interview talking point: “The trailing & in the map expands to the key being looked up, so requesting /home/alice maps straight to the alice directory without writing one line per user.”

Q105: How do you configure NFS automount?

What it is: autofs mounts on demand using /etc/auto.master pointing to a direct map /etc/auto.direct, which maps /mnt/nfs to server:/share with rw,soft,intr, and the service is enabled with systemctl.

Why it is used: NFS shares attach when accessed and time out when idle, avoiding boot hangs on a dead server.

/- /etc/auto.direct

# /etc/auto.direct
/mnt/nfs -rw,soft,intr server:/share

# Start
systemctl enable autofs
systemctl start autofs

# Test
ls /mnt/nfs

Interview talking point: “The soft,intr mount options let I/O fail or be interrupted rather than hang forever, which is exactly what you want when the NFS server goes offline.”

Swap

Q106: How do you create encrypted swap?

What it is: Swap gives the kernel disk space to page memory out when RAM runs low. This record builds a swap file with dd, mkswap, an fstab entry and swapon, then checks it with swapon -s and free -h.

Why it is used: To add paging capacity on a host that has run out of RAM or needs headroom for bursts.

# Create encrypted swap
dd if=/dev/zero of=/swapfile bs=1M count=2048
chmod 600 /swapfile
mkswap /swapfile

# Add to /etc/fstab
/swapfile none swap sw 0 0

# Enable
swapon /swapfile

# Verify
swapon -s
free -h

Interview talking point: “The sequence matters: create the file, chmod 600 so only root touches it, mkswap to format, then swapon, with the fstab line so it returns after reboot, and swapon -s and free -h confirm it.”

Quotas

Q107: How do you configure disk quotas?

What it is: Disk quotas cap per-user and per-group space on a mount, enabled via usrquota in fstab, quotacheck, and quotaon, with limits edited by edquota.

Why it is used: To stop one account filling a shared filesystem and starving everyone else.

# Enable quota
/dev/sda1 /home ext4 usrquota,grpquota 0 2

# Remount
mount -o remount /home

# Initialize quota
quotacheck -cug /home

# Enable quota
quotaon /home

# Set user quota
edquota -u username
# Edit soft/hard limits

# Set group quota
edquota -g groupname

# View quota
quota -u username
quota -g groupname
repquota -a

# Copy quota template
edquota -p template_user new_user

# Email reports
# /etc/cron.daily/quotas
quotacheck -avug
repquota -a | mail -s "Quota Report" admin@example.com

Interview talking point: “Soft limits allow a grace period while hard limits block further writes outright, and edquota -p copies one user limits template onto a new account.”

Q108: How do you configure storage quota?

What it is: A ResourceQuota named storage-quota caps total requested storage at 100Gi and limits the namespace to 10 persistent volume claims.

Why it is used: To stop a namespace from consuming unbounded storage in a shared cluster.

# Kubernetes ResourceQuota
apiVersion: v1
kind: ResourceQuota
metadata:
  name: storage-quota
spec:
  hard:
    requests.storage: 100Gi
    persistentvolumeclaims: "10"

Interview talking point: “The quota counts requests.storage and persistentvolumeclaims, so both capacity and object count are bounded, and pods asking for more than the remainder are rejected.”

Q109: How do you implement user quotas?

What it is: User quotas limit how much disk space one account may use on a filesystem. The record enables usrquota and grpquota in fstab, runs quotacheck -augm, sets limits with edquota, and turns quotas on with quotaon.

Why it is used: To stop one user filling a shared filesystem and taking the machine down for everyone else.

# Install
apt install quota

# Enable quota in fstab
# Add usrquota,grpquota to /etc/fstab
# /dev/sda1 / ext4 defaults,usrquota,grpquota 0 0

# Remount
mount -o remount /

# Initialize quota
quotacheck -augm

# Set user quota
edquota -u username

# Enable quota
quotaon -uv /

# Check quota
quota -u username
repquota -a

Interview talking point: “The order is what trips people up: remount with quota options, quotacheck to build the database, edquota to set the limits, then quotaon; repquota -a then reports usage for every account.”

Q110: How do you implement user quotas?

What it is: User and group disk quotas cap how much space an account may use on a filesystem. usrquota and grpquota mount options, quotacheck, edquota, and quotaon set and enforce the limits.

Why it is used: To stop one user or tenant from filling a shared home or data volume.

# Enable quota
/dev/sda1 /home ext4 defaults,usrquota,grpquota 0 2

# Remount
mount -o remount /home

# Initialize
quotacheck -aug

# Set quota
edquota -u username

# Enable
quotaon /home

# Check
quota -u username
repquota -a

Interview talking point: “quotacheck -aug builds the quota database, while edquota opens an editor to set the actual soft and hard limits. repquota -a reports across all filesystems, whereas quota -u shows usage for a single user.”

Q111: How do you manage disk quotas?

What it is: Disk quotas limit how much space a user or group may use on a filesystem. quotacheck builds quota files, edquota edits soft and hard limits, and repquota reports usage.

Why it is used: To stop one user or group from filling a shared filesystem such as /home.

# Enable quota
quotacheck -cug /home

# Set quota
edquota -u username
# Edit soft/hard limits

# Check quota
quota -u username
quota -g groupname

# Report
repquota -a
repquota -aug

# Enable at boot
# /etc/fstab
/dev/sda1 /home ext4 defaults,usrquota,grpquota 0 2

Interview talking point: “Soft limits may be crossed only within a grace period while hard limits cannot be crossed at all, and the usrquota and grpquota options in fstab are what make quotas active again after a reboot.”

Q112: How do you manage disk quotas?

What it is: Disk quotas cap how much space a user or group may use on a mount, enabled via fstab options, initialized with quotacheck, then set with edquota or setquota.

Why it is used: To stop one account from filling a shared home filesystem and taking everyone down.

# Enable quota
/dev/sda1 /home ext4 usrquota,grpquota 0 2

# Initialize quota
quotacheck -cug /home
quotaon /home

# Set quotas
edquota -u username
# or
setquota -u username 10000 15000 1000 2000 /home

# Check quota
quota -u username
repquota -a

Interview talking point: “Quota limits apply only after usrquota or grpquota is in fstab and quotaon has run, and the values given to setquota are block and inode ceilings. repquota -a reports usage across quota-enabled filesystems.”

Q113: How do you use Kubernetes ResourceQuota?

What it is: A ResourceQuota sets hard ceilings in a namespace: total CPU and memory requests and limits, plus counts of objects such as pods and services.

Why it is used: To stop one team or namespace from consuming a cluster’s whole capacity.

apiVersion: v1
kind: ResourceQuota
metadata:
  name: myquota
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi
    pods: "10"
    services: "5"

Interview talking point: “Requests and limits are tracked separately, so quota enforcement works even for pods that never declare limits of their own.”

LVM

Q114: How do you resize LVM?

What it is: lvextend grows a logical volume by a size such as 10G followed by resize2fs, while shrinking unmounts, runs e2fsck -f, resizes the filesystem first, then lvreduce.

Why it is used: To expand or contract storage without repartitioning the disk.

# Extend logical volume
lvextend -L +10G /dev/vg_data/lv_data
resize2fs /dev/vg_data/lv_data

# Reduce logical volume
umount /mnt/data
e2fsck -f /dev/vg_data/lv_data
resize2fs /dev/vg_data/lv_data 5G
lvreduce -L 5G /dev/vg_data/lv_data

Interview talking point: “extension goes volume first then filesystem, but reduction does it the other way round, and the filesystem must be unmounted and checked before lvreduce can safely run.”

Q115: How do you configure LVM?

What it is: LVM layers physical volumes into a volume group, from which logical volumes are carved, resized, snapshotted, and provisioned from thin pools.

Why it is used: To grow storage online and to snapshot data before risky changes.

# Create physical volume
pvcreate /dev/sdb1
pvdisplay
pvmove /dev/sdb1 /dev/sdc1

# Create volume group
vgcreate vg_data /dev/sdb1
vgextend vg_data /dev/sdc1
vgdisplay

# Create logical volume
lvcreate -L 10G -n lv_data vg_data
lvcreate -l 100%FREE -n lv_backup vg_data

# Create thin pool
lvcreate -L 100G --thinpool vg_data/thin_pool
lvcreate -V 10G --thin -n lv_thin vg_data/thin_pool

# Snapshot
lvcreate -s -L 5G -n lv_snap vg_data/lv_data

# Resize
lvextend -L +10G /dev/vg_data/lv_data
lvreduce -L -5G /dev/vg_data/lv_data

# Remove
lvremove /dev/vg_data/lv_data
vgremove vg_data
pvremove /dev/sdb1

Interview talking point: “lvcreate -s makes a snapshot volume with its own size budget, while lvcreate -V with —thin provisions a virtual size larger than the pool backing it.”

Q116: How do you create and manage LVM?

What it is: LVM layers physical volumes into a volume group, from which logical volumes are carved, formatted, mounted, and resized without repartitioning the disk.

Why it is used: To grow storage online and pool disks into flexible space instead of fixed partitions.

# Physical volume
pvcreate /dev/sdb1
pvdisplay
pvscan

# Volume group
vgcreate vg_data /dev/sdb1
vgdisplay
vgextend vg_data /dev/sdc1

# Logical volume
lvcreate -L 10G -n lv_mydata vg_data
lvcreate -l 100%FREE -n lv_backup vg_data

# Format and mount
mkfs.xfs /dev/vg_data/lv_mydata
mount /dev/vg_data/lv_mydata /mnt/data

# Resize
lvextend -L +5G /dev/vg_data/lv_mydata
resize2fs /dev/vg_data/lv_mydata

Interview talking point: “lvextend grows the volume while resize2fs grows the filesystem, and both steps are needed. lvcreate -l 100%FREE hands all remaining extents to one volume, leaving nothing free for later growth.”

Q117: How do you create LVM?

What it is: LVM layers storage: pvcreate makes a physical volume, vgcreate builds a volume group, and lvcreate carves out a logical volume that is then formatted and mounted.

Why it is used: To pool disks into flexible storage that can be extended later.

# Create physical volume
pvcreate /dev/sdb1

# Create volume group
vgcreate vg_data /dev/sdb1

# Create logical volume
lvcreate -L 10G -n lv_data vg_data

# Format and mount
mkfs.ext4 /dev/vg_data/lv_data
mount /dev/vg_data/lv_data /mnt/data

Interview talking point: “the order is pv, then vg, then lv, and the resulting device path /dev/vg_data/lv_data is simply built from the volume group name and the logical volume name.”

Q118: How do you create thin pool?

What it is: A thin pool is a shared free-space reservoir created with lvcreate —thinpool, from which thinly provisioned LVs are carved with -V and —thin, and activated with lvchange -ay.

Why it is used: Hand out large virtual sizes to many volumes while only storing the space actually written.

# Create thin pool
lvcreate -L 20G --thinpool thin_pool vg

# Create thin LV
lvcreate -V 100G --thin -n thin_lv vg/thin_pool

# Activate
lvchange -ay vg/thin_lv

Interview talking point: “The 100G thin LV in the example sits in a 20G pool, so overcommit only works until the pool fills, and monitoring pool usage is what prevents running out of space.”

Q119: How do you use LVM cache?

What it is: LVM cache creates a cache-pool LV on an SSD volume group, then a cache LV on an HDD group that uses that pool, giving a hybrid volume.

Why it is used: Speed up a large spinning-disk logical volume using a small SSD as cache.

# Create cache pool
lvcreate --type cache-pool -L 10G -n cache_pool vg_ssd

# Create cached LV
lvcreate --type cache -L 10G --cachepool cache_pool -n cached_lv vg_hdd

Interview talking point: “The cache pool and the cached LV can live in different volume groups, vg_ssd and vg_hdd in the example, which lets you attach fast storage without moving the data volume.”

Q120: How do you use LVM metadata backup?

What it is: vgcfgbackup writes volume group metadata to /etc/lvm/backup, vgcfgrestore puts it back, and lvm.conf’s backup block controls whether backups run and how many days and copies are retained.

Why it is used: Recover LVM layout after accidental changes or corruption without restoring the data itself.

# Backup
vgcfgbackup

# View backup
ls -l /etc/lvm/backup/

# Restore
vgcfgrestore vg_name

# Automated backup
# /etc/lvm/lvm.conf
backup {
    backup = 1
    backup_dir = "/etc/lvm/backup"
    retain_min = 10
    retain_days = 30
}

Interview talking point: “These backups capture metadata like PV and LV layout, not file contents, so they restore the structure of the volume group while the data on disk stays untouched.”

Q121: How do you use LVM snapshots for backups?

What it is: An LVM snapshot is a copy-on-write point created with lvcreate -s and a size, mounted read-only, used as a source for a tar backup, then deleted with lvremove.

Why it is used: Take a consistent point-in-time backup of a live filesystem without stopping services.

# Create snapshot
lvcreate -s -L 5G -n backup_snap /dev/vg/lv

# Mount snapshot
mount -o ro /dev/vg/backup_snap /mnt/snap

# Backup
tar -czf /backup/backup.tar.gz -C /mnt/snap .

# Remove snapshot
lvremove /dev/vg/backup_snap

Interview talking point: “The snapshot size is the room for changes rather than a copy of the data, so if writes exceed it the snapshot breaks, and mounting it read-only keeps the backup consistent.”

Q122: How do you use LVM snapshots?

What it is: An LVM snapshot is a point-in-time copy of a logical volume, made with lvcreate -L 10G -s, mounted like any volume, and deleted with lvremove.

Why it is used: Quick pre-change copies of a volume without duplicating all its data first.

# Create snapshot
lvcreate -L 10G -s -n snap_name /dev/vg/lv

# Mount snapshot
mount /dev/vg/snap /mnt/snap

# Remove snapshot
lvremove /dev/vg/snap

Interview talking point: “The snapshot gets its own space for blocks that change afterwards, so its size must be planned; mount it to read the frozen state, then lvremove to release the space.”

Q123: How do you use LVM snapshots?

What it is: An LVM snapshot freezes the state of a logical volume as blocks change. lvcreate makes a 10G snapshot, it mounts read-only, lvconvert —merge rolls the origin back to snapshot state, and lvremove deletes the snapshot.

Why it is used: To checkpoint a volume before upgrades or destructive changes and roll back if needed.

# Create snapshot
lvcreate -L 10G -s -n snap /dev/vg/lv

# Mount snapshot
mkdir -p /mnt/snap
mount -o ro /dev/vg/snap /mnt/snap

# Restore
umount /mnt/snap
lvconvert --merge /dev/vg/snap

# Remove
lvremove /dev/vg/snap

Interview talking point: “The snapshot size only reserves room for changed blocks, and merging it destroys every change made to the origin since the snapshot was taken, so unmount first.”

Q124: How do you use LVM thin provisioning?

What it is: A thin pool is a region of an LVM volume group from which thin volumes draw space on demand. lvcreate -V makes a thin volume larger than the pool physically holds.

Why it is used: To oversubscribe storage so virtual volumes consume space only as data is written.

# Create thin pool
lvcreate -L 100G --thinpool thin_pool vg_data

# Create thin volume
lvcreate -V 200G --thin -n thin_vol vg_data/thin_pool

# Monitor
lvs -a
lvdisplay vg_data/thin_pool

# Extend pool
lvextend -L +50G vg_data/thin_pool

Interview talking point: “The example provisions a 200G thin volume backed by a 100G pool, so watching lvs -a and lvdisplay on the pool matters because exhaustion of the pool is the operational risk.”

RAID

Q125: What is RAID and how do you configure it in Linux?

What it is: RAID stripes or mirrors several disks for speed or redundancy; mdadm builds software RAID arrays such as level 5 over three devices and monitors their health.

Why it is used: To survive a disk failure and, in RAID 5, keep writing with one disk down.

# Software RAID with mdadm
mdadm --create /dev/md0 --level=5 --raid-devices=3 /dev/sdb1 /dev/sdc1 /dev/sdd1

# Manage RAID
mdadm --detail /dev/md0
cat /proc/mdstat

# Add spare
mdadm /dev/md0 --add /dev/sde1

# Monitor
mdadm --monitor --mail=admin@example.com --daemonize /dev/md0

Interview talking point: “cat /proc/mdstat shows array state and rebuild progress in real time, while mdadm —detail gives device-level status. Adding a spare with —add lets the array rebuild automatically when a disk fails.”

Q126: How do you monitor MD RAID?

What it is: MD RAID state comes from /proc/mdstat and mdadm —detail, while mdadm —monitor runs as a daemon and emails admin@example.com on events, with logs rotated by a logrotate entry.

Why it is used: Catch a disk failure early rather than discovering it when a second disk fails.

# Check status
cat /proc/mdstat

# Detailed
mdadm --detail /dev/md0

# Monitor
mdadm --monitor --daemonise --mail=admin@example.com /dev/md0

# Log rotation
# /etc/logrotate.d/mdadm
/var/log/mdadm.log {
    weekly
    rotate 4
}

Interview talking point: “—monitor —daemonise is the piece that alerts you, and pairing it with logrotate keeps the mdadm log bounded instead of growing until it fills the disk.”

Q127: How do you convert RAID levels?

What it is: mdadm —grow changes an array’s level and device count, here moving to RAID 5 after adding a device, while —fail and —replace swap in a different disk under manage.

Why it is used: Expand or change an array in place instead of rebuilding everything from a restore.

# Convert RAID1 to RAID5
mdadm --grow /dev/md0 --level=5 --raid-devices=3
mdadm --add /dev/md0 /dev/sdc1

# Convert to larger disk
mdadm --manage /dev/md0 --fail /dev/sdb1
mdadm --manage /dev/md0 --replace /dev/sdb1

Interview talking point: “The device count and the level change together, so the example adds /dev/sdc1 first and then grows to level 5 with three devices, and —fail marks a disk bad so —replace can swap it.”

Q128: How do you configure RAID?

What it is: mdadm creates software arrays such as RAID5, RAID10, or RAID1 with a spare, then manages them by adding, failing, and removing member disks.

Why it is used: To get redundancy and performance from local disks and to rebuild after a failure.

# Create RAID5
mdadm --create /dev/md0 --level=5 --raid-devices=4 /dev/sd[b-e]1

# Create RAID10
mdadm --create /dev/md0 --level=10 --raid-devices=4 /dev/sd[b-e]1

# Create RAID1 with spare
mdadm --create /dev/md0 --level=1 --raid-devices=2 --spare-devices=1 /dev/sd[b-d]1

# Monitor
mdadm --detail /dev/md0
cat /proc/mdstat

# Add to /etc/mdadm.conf
mdadm --examine --scan >> /etc/mdadm.conf

# Manage
mdadm /dev/md0 --add /dev/sdf1
mdadm /dev/md0 --remove /dev/sdb1
mdadm /dev/md0 --fail /dev/sdb1

# Stop/start
mdadm --stop /dev/md0
mdadm --assemble /dev/md0

Interview talking point: “/proc/mdstat shows build or rebuild progress live, and —fail marks a disk bad before —remove so the array knows to reconstruct onto a replacement.”

Q129: How do you create RAID?

What it is: mdadm creates a software RAID array, here RAID5 over three devices, reports state with —detail, and lets a device be flagged faulty and removed from the array.

Why it is used: To combine disks for redundancy so one drive failure does not lose data.

# Create RAID5
mdadm --create /dev/md0 --level=5 --raid-devices=3 /dev/sdb1 /dev/sdc1 /dev/sdd1

# Monitor RAID
mdadm --detail /dev/md0

# Simulate failure
mdadm /dev/md0 --set faulty /dev/sdb1

# Remove failed drive
mdadm /dev/md0 --remove /dev/sdb1

Interview talking point: “after —set faulty and —remove, the array keeps running degraded on the remaining disks, and mdadm —detail /dev/md0 is how you confirm the array’s current state.”

Q130: How do you use mdadm for software RAID?

What it is: mdadm manages Linux software RAID. The record creates a RAID 5 array of three disks and a RAID 10 array of four, checks with mdadm —detail and /proc/mdstat, stops an array, removes and adds disks, and monitors array health by mail.

Why it is used: To get redundancy or speed across several disks without a hardware RAID controller.

# Create RAID 5
mdadm --create /dev/md0 --level=5 --raid-devices=3 /dev/sdb /dev/sdc /dev/sdd

# Create RAID 10
mdadm --create /dev/md0 --level=10 --raid-devices=4 /dev/sdb /dev/sdc /dev/sdd /dev/sde

# Check status
mdadm --detail /dev/md0
cat /proc/mdstat

# Stop array
mdadm --stop /dev/md0

# Remove failed disk
mdadm /dev/md0 --remove /dev/sdb

# Add new disk
mdadm --add /dev/md0 /dev/sde

# Monitor
mdadm --monitor --daemonise --mail=admin@example.com /dev/md0

Interview talking point: “Rebuild is a maintenance workflow: mdadm —remove takes out the failed disk, mdadm —add lets the array rebuild onto a new one, and mdadm —monitor with daemonise emails you when the array degrades.”

Q131: How do you use mdadm with bitmap?

What it is: A bitmap records which regions of an array are out of date, added internally or to an external file like /boot/md0.bitmap with mdadm —grow, and removed with —bitmap=none.

Why it is used: Cut resync time after a reboot by tracking what needs rebuilding.

# Add bitmap
mdadm --grow /dev/md0 --bitmap=internal

# Add external bitmap
mdadm --grow /dev/md0 --bitmap=/boot/md0.bitmap

# Remove bitmap
mdadm --grow /dev/md0 --bitmap=none

Interview talking point: “The bitmap can live inside the array or in an external file, and if it is external it must be readable at boot or the array loses that resync shortcut.”

Q132: How do you use RAID 10?

What it is: RAID 10 is created with mdadm —create at level 10 across four devices, with a layout option such as n2 where n is near, alongside far and offset variants.

Why it is used: Combine mirroring and striping for fast random I/O with redundancy.

# Create RAID 10
mdadm --create /dev/md0 --level=10 --raid-devices=4 /dev/sdb1 /dev/sdc1 /dev/sdd1 /dev/sde1

# Layout
# n = near (default)
# f = far
# o = offset

mdadm --create /dev/md0 --level=10 --raid-devices=4 --layout=n2 /dev/sdb1 /dev/sdc1 /dev/sdd1 /dev/sde1

Interview talking point: “The layout letters change how stripes are placed, near by default, far or offset as alternatives, and the layout option only becomes meaningful once you go beyond a simple mirror pair.”

Q133: How do you use RAID 6?

What it is: mdadm —create builds a RAID 6 array named /dev/md0 from four devices at level 6, optionally with a spare added to the command, and progress is checked in /proc/mdstat.

Why it is used: Parity-protected storage that survives two simultaneous disk failures.

# Create RAID 6
mdadm --create /dev/md0 --level=6 --raid-devices=4 /dev/sdb1 /dev/sdc1 /dev/sdd1 /dev/sde1

# With spare
mdadm --create /dev/md0 --level=6 --raid-devices=4 --spare-devices=1 /dev/sdb1 /dev/sdc1 /dev/sdd1 /dev/sde1 /dev/sdf1

# Check
cat /proc/mdstat

Interview talking point: “RAID 6 uses double parity, so with four data devices you can lose two and keep running, and the optional spare lets a rebuild start automatically after a failure.”

Advanced Filesystems

Q134: How do you configure bcache?

What it is: bcache uses a fast device as a cache in front of a slower backing device. make-bcache prepares the cache device with -C and backing devices with -B, the devices are registered and attached through sys files, and a filesystem is made on bcache0.

Why it is used: To speed up a large slow disk by serving hot data from a smaller fast device.

# Install
apt install bcache-tools

# Create backing device
make-bcache -C /dev/sdb
# or
make-bcache -B /dev/sdc  # backing

# Create cache device
make-bcache -C /dev/sda

# Register
echo /dev/sdb > /sys/block/bcache0/bcache/register
echo /dev/sda > /sys/block/bcache0/cache/register

# Attach
echo /dev/sda > /sys/block/bcache0/bcache0/bcache/attach

# Make filesystem
mkfs.ext4 /dev/bcache0
mount /dev/bcache0 /mnt

Interview talking point: “The backing device holds the real data and the cache device sits in front of it, and registration happens by echoing device paths into /sys/block/bcache0 before mkfs.ext4 runs on the bcache0 device.”

Q135: How do you configure SquashFS?

What it is: SquashFS is a compressed read-only filesystem image. mksquashfs packs a directory into output.squashfs with xz compression, the image is mounted through a loop device, and unsquashfs lists or extracts files from it.

Why it is used: To ship application or live-CD contents in one small file that cannot be modified after creation.

# Create squashfs
mksquashfs source_dir output.squashfs -comp xz

# Mount squashfs
mount -t squashfs -o loop image.squashfs /mnt/squash

# List contents
unsquashfs -l image.squashfs

# Extract specific file
unsquashfs -e image.squashfs file.txt

# With compression options
mksquashfs source output.squashfs -comp xz -Xbcj x86

Interview talking point: “Because it is read-only you mount it with -o loop and never write to it, while unsquashfs -l and unsquashfs -e let you inspect or pull a single file out without unpacking everything.”

Q136: How do you use FUSE?

What it is: FUSE lets user-space programs implement a filesystem; sshfs mounts a remote directory locally and fusermount -u unmounts it again.

Why it is used: To mount remote or custom filesystems without writing any kernel code.

# Install
apt install fuse libfuse-dev

# Example using sshfs
sshfs user@host:/remote /local/mount

# Unmount
fusermount -u /local/mount

# List available
ls /dev/fuse
cat /proc/filesystems | grep fuse

Interview talking point: “FUSE mounts are torn down with fusermount -u rather than plain umount, and you can confirm support by checking /dev/fuse and grep fuse in /proc/filesystems.”

Q137: How do you use overlay filesystem?

What it is: Overlayfs merges a lowerdir, upperdir, and workdir into one merged mount, where writes land in the upper layer.

Why it is used: To give containers cheap copy-on-write image layers, with modprobe overlay loading the kernel support.

# Mount overlay
mount -t overlay overlay -o lowerdir=/lower,upperdir=/upper,workdir=/work /merged

# In Docker
# Uses overlay2 by default

# Kernel module
modprobe overlay

Interview talking point: “Because only changes go to the upperdir, deleting a file marks a whiteout there while the lower layer stays untouched, which is exactly how Docker image layers behave.”

Q138: How do you use Stratis for storage management?

What it is: Stratis pools block devices into a managed pool and creates filesystems on it. stratisd runs as the service, pool create combines sdb and sdc, fs create makes myfs, which is then mounted from /stratis/mypool/myfs.

Why it is used: To combine several disks into one usable pool with less manual volume setup.

# Install
apt install stratisd stratis-cli

# Start service
systemctl start stratisd

# Create pool
stratis pool create mypool /dev/sdb /dev/sdc

# Create filesystem
stratis fs create mypool myfs

# Mount
mount /stratis/mypool/myfs /mnt

# List
stratis pool list
stratis fs list

Interview talking point: “The structure is two levels, a pool created from devices and a filesystem created inside the pool, so stratis pool list and stratis fs list show the hierarchy before you mount it.”

Q139: How do you use Stratis?

What it is: Stratis is a storage manager that pools block devices with stratis pool create and then carves filesystems out of that pool.

Why it is used: To get thin provisioning and simpler management by handling a pool and filesystem together.

# Install
apt install stratisd stratis-cli

# Start
systemctl start stratisd

# Create pool
stratis pool create mypool /dev/sdb /dev/sdc

# Create filesystem
stratis fs create mypool myfs

# Mount
mount /stratis/mypool/myfs /mnt

# List
stratis pool list
stratis fs list

Interview talking point: “The order matters: stratis pool create mypool with two disks first, then stratis fs create mypool myfs, then mount under /stratis/mypool/myfs.”

Q140: How do you use VDO (Virtual Data Optimizer)?

What it is: VDO is a device-mapper layer that compresses and deduplicates blocks, presenting a larger logical size than the backing device provides.

Why it is used: To stretch expensive storage capacity by removing duplicate and compressible data.

# Install
apt install vdo kmod-kvdo

# Create VDO
vdo create --name=vdo0 --device=/dev/sdb --vdoLogicalSize=100G

# Format
mkfs.xfs /dev/mapper/vdo0

# Mount
mount /dev/mapper/vdo0 /mnt

# Deduplication
vdo enableDeduplication vdo0
vdo enableCompression vdo0

Interview talking point: “vdo create sets a vdoLogicalSize of 100G over the real disk, and after mkfs.xfs on /dev/mapper/vdo0 you enable deduplication and compression as separate vdo commands.”

Device Mapper, Encryption, and Multipath

Q141: How do you configure device mapper multipath?

What it is: Device mapper multipath aggregates multiple paths to the same storage device into one logical device. multipath.conf sets defaults and an alias for a WWID, multipathd runs as the service, and multipath -ll lists the paths.

Why it is used: To keep storage reachable when one SAN path or HBA fails, and to present a stable device name.

# Install
apt install multipath-tools

# Configure /etc/multipath.conf
defaults {
    user_friendly_names yes
    find_multipaths yes
}

multipaths {
    multipath {
        wwid "3600605b00e0c960018e0c95c00000000"
        alias mpath0
    }
}

# Start service
systemctl start multipathd
systemctl enable multipathd

# Commands
multipath -ll
multipath -f mpath0

Interview talking point: “user_friendly_names yes gives readable aliases like mpath0 instead of the raw WWID, and multipath -ll is the first check for path state while multipath -f removes a mapping.”

Q142: How do you configure dm-crypt with LUKS?

What it is: cryptsetup luksFormat writes a LUKS header on /dev/sdb1, cryptsetup open exposes it as /dev/mapper/crypt_vol, which is then formatted with mkfs.xfs, mounted, and closed after unmounting.

Why it is used: Encrypt disks so data is unreadable without the passphrase if the hardware is lost or stolen.

# Create
cryptsetup luksFormat /dev/sdb1

# Open
cryptsetup open /dev/sdb1 crypt_vol

# Format
mkfs.xfs /dev/mapper/crypt_vol

# Mount
mount /dev/mapper/crypt_vol /mnt

# Close
umount /mnt
cryptsetup close crypt_vol

Interview talking point: “luksFormat and open are separate steps because the volume stays locked until someone supplies a passphrase, and cryptsetup close is what tears down the mapper device after the unmount.”

Q143: How do you configure dm-verity?

What it is: veritysetup format computes integrity metadata from a data device into a hash device, producing parameters, veritysetup open exposes the verified device, and verify checks it against the same pair.

Why it is used: Detect any modification of read-only system partitions, common on immutable and embedded systems.

# Create verity device
veritysetup format /dev/sda1 /dev/sda2 > verity_params

# Mount
veritysetup open /dev/sda2 verity_root /dev/sda1

# Check
veritysetup verify /dev/sda2 verity_root /dev/sda1

Interview talking point: “The hash tree lives on a separate device from the data, so a tampered root partition fails verification at read time instead of silently running modified code.”

Q144: How do you configure multipath I/O?

What it is: Device-mapper multipath aggregates multiple storage paths into a single logical device for redundancy.

Why it is used: Improve availability and load balancing for SAN-attached storage systems.

# Install
apt install multipath-tools

# Configure
# /etc/multipath.conf
defaults {
    user_friendly_names yes
    find_multipaths yes
}

devices {
    device {
        vendor "Dell"
        product "MD36*"
        path_grouping_policy multibus
        path_checker tur
        features "0"
        hardware_handler "0"
    }
}

# Start multipathd
systemctl start multipathd

# Commands
multipath -ll
multipath -v2
multipath -F

# Add path
multipath /dev/sda

# Get WWID
multipath -l /dev/sda

Interview talking point: “find_multipaths auto-detects multipath devices, and WWIDs uniquely identify targets across different paths.”

Q145: How do you use device mapper?

What it is: dmsetup creates a mapped device from a table line, here a linear mapping of 100000 sectors from /dev/sdb1 to a new volume, removed with dmsetup remove and inspected with status and table.

Why it is used: Build virtual block devices that layer or translate underlying storage for LVM, encryption, and tests.

# Create linear mapping
echo "0 100000 linear /dev/sdb1 0" | dmsetup create vol1

# Remove
dmsetup remove vol1

# Status
dmsetup status
dmsetup table

Interview talking point: “The table line is offset, length, target, and backing device, and dmsetup table prints exactly that mapping, which is how you confirm what a device really points at.”

Q146: How do you use dm-cache?

What it is: dm-cache is a device-mapper target that keeps hot blocks of a slow device on a faster cache device.

Why it is used: To accelerate a large slow volume using a small fast SSD.

# Create cache
dmsetup create cache0 --table "0 2097152 cache /dev/sda3 /dev/sdb1 /dev/sdc1 128 2 checkpoint 2 threshold 2"

# Check status
dmsetup status cache0

# Remove
dmsetup remove cache0

Interview talking point: “dmsetup create cache0 takes a table line naming origin, cache, and metadata devices, dmsetup status cache0 reports hits and misses, and dmsetup remove tears the mapping down.”

Q147: How do you use dm-zero and dm-null?

What it is: These are small device mapper targets used for testing, shown here creating zero and null devices with dmsetup and then writing to the mapper device with dd.

Why it is used: Provide throwaway block devices for experiments and benchmarks without touching real disks.

# Null device (discard writes)
dmsetup create null /dev/zero 0

# Zero device (return zeros)
dmsetup create zero /dev/null 0

# Use for testing
dd if=/dev/zero of=/dev/mapper/zero bs=1M count=100

Interview talking point: “The comments distinguish a null device that discards writes from a zero device that returns zeros, and the dd write to /dev/mapper/zero shows how to exercise a mapper device without real storage.”

Q148: How do you use Linux dm-crypt/LUKS?

What it is: cryptsetup luksFormat turns a file or disk into a LUKS encrypted volume. cryptsetup open maps it to /dev/mapper/cryptvol, where you make a filesystem, mount it, then close it.

Why it is used: To protect data at rest so an unmounted volume cannot be read without the passphrase.

# Create encrypted container
dd if=/dev/zero of=/container bs=1M count=1000
cryptsetup luksFormat /container

# Open
cryptsetup open /container cryptvol

# Format
mkfs.ext4 /dev/mapper/cryptvol

# Mount
mount /dev/mapper/cryptvol /mnt

# Close
umount /mnt
cryptsetup close cryptvol

Interview talking point: “Nothing is usable until luksFormat and open both succeed, since open is what exposes /dev/mapper/cryptvol for mkfs and mount. The clean shutdown order is umount followed by cryptsetup close, which removes the mapper entry.”

Q149: How do you use multipath?

What it is: device-mapper multipath aggregates redundant storage paths to one device: multipath -ll lists maps, -a and -d add or remove a path, and multipath.conf assigns friendly aliases by WWID.

Why it is used: Gives failover and extra bandwidth when a host sees the same LUN over several HBAs or ports.

# List
multipath -ll

# Add path
multipath -a /dev/sdb

# Remove
multipath -d /dev/sdb

# Format
# /etc/multipath.conf
multipaths {
    "3600605b00e0c960018e0c95c00000000" {
        alias mpath0
    }
}

Interview talking point: “The WWID in multipath.conf is what ties paths together, and giving it an alias such as mpath0 yields a stable /dev name instead of the sdX letter drifting across reboots or rescans.”

Q150: How do you use VeraCrypt?

What it is: VeraCrypt creates encrypted containers with veracrypt -c, mounts a container at a mount point such as /mnt/veracrypt, and dismounts it with -d so the contents become inaccessible again.

Why it is used: Carry encrypted files in a single container that can be shared or moved between machines.

# Install
apt install veracrypt

# Create volume
veracrypt -c

# Mount
veracrypt /path/to/container /mnt/veracrypt

# Dismount
veracrypt -d /path/to/container

Interview talking point: “Dismounting with -d is what makes the container opaque again, and anything still open on the mounted path has to be closed before the dismount succeeds.”

Q151: How do you configure encrypted filesystems?

What it is: LUKS formats a partition with a header holding key slots, opens it as a mapper device, which is then formatted and mounted. crypttab enables unlock at boot.

Why it is used: To protect data at rest on laptops, backups, or shared servers.

# LUKS encryption
cryptsetup luksFormat /dev/sdb1
cryptsetup luksOpen /dev/sdb1 encrypted
mkfs.xfs /dev/mapper/encrypted

# Add key
cryptsetup luksAddKey /dev/sdb1

# Backup header
cryptsetup luksHeaderBackup /dev/sdb1 --header-backup-file header.img

# Auto unlock
# /etc/crypttab
encrypted /dev/sdb1 none luks

# /etc/fstab
/dev/mapper/encrypted /mnt/data xfs defaults 0 2

# eCryptfs
mount -t ecryptfs /backup /encrypted
# Or use fscrypt
mkfs.ext4 -O encrypt /dev/sda1
mount /dev/sda1 /mnt
fscrypt setup
fscrypt encrypt /mnt

Interview talking point: “A LUKS header backup matters because losing the header loses every key, and luksAddKey lets you add a passphrase without replacing the existing ones.”

Q152: How do you configure encrypted storage?

What it is: LUKS encrypts block devices with multiple key slots and requires unlocking before mounting the filesystem.

Why it is used: Protect data at rest from unauthorized access if physical storage is compromised.

# LUKS encryption
cryptsetup luksFormat /dev/sdb1

# Open container
cryptsetup luksOpen /dev/sdb1 encrypted_volume

# Create filesystem
mkfs.xfs /dev/mapper/encrypted_volume

# Mount
mount /dev/mapper/encrypted_volume /mnt/data

# Add key slot
cryptsetup luksAddKey /dev/sdb1

# Backup header
cryptsetup luksHeaderBackup /dev/sdb1 --header-backup-file header.img

# Auto unlock
# /etc/crypttab
encrypted_volume /dev/sdb1 none luks

# /etc/fstab
/dev/mapper/encrypted_volume /mnt/data xfs defaults 0 2

Interview talking point: “Backing up the LUKS header is critical for recovery; crypttab enables automated unlocking during boot when configured.”

Q153: How do you implement full disk encryption?

What it is: LUKS encrypts a partition with cryptsetup luksFormat, and luksHeaderBackup saves the key header to an image file for safekeeping.

Why it is used: To protect data at rest on disks that may be lost or stolen.

# During installation
# Use LVM with LUKS

# After installation
# Use dm-crypt
cryptsetup luksFormat /dev/sdb1

# Backup header
cryptsetup luksHeaderBackup /dev/sdb1 --header-backup-file /root/luks-header.img

Interview talking point: “Backing up the LUKS header with luksHeaderBackup matters because losing that header means losing access to every passphrase on the device.”

Network Storage

Q154: How do you configure CIFS/SMB?

What it is: Samba provides CIFS shares for Windows-style access. smb.conf defines global settings and per-share paths with browse and write flags, users get a separate smb password, and testparm validates the configuration.

Why it is used: To share directories with Windows clients or mount a remote share on Linux.

# Install
apt install samba

[global]
    workgroup = WORKGROUP
    server string = File Server
    security = user
    map to guest = bad user
    dns proxy = no

[shared]
    path = /srv/samba/shared
    browsable = yes
    writable = yes
    guest ok = yes
    read only = no

[private]
    path = /srv/samba/private
    valid users = @smbgroup
    writable = yes
    browseable = no

# Create user
useradd -m smbuser
smbpasswd -a smbuser

# Test config
testparm

# Client
mount -t cifs //server/share /mnt -o user=smbuser

Interview talking point: “smbpasswd creates a Samba-specific password separate from the system account password, and testparm is run before restarting so config errors surface before the service fails to start.”

Q155: How do you configure CIFS?

What it is: CIFS mounts Windows-style shares using cifs-utils, either manually with mount -t cifs or from fstab with a credentials file holding username, password and domain.

Why it is used: To access SMB shares from Linux while keeping login details out of mount commands.

# Install client
apt install cifs-utils

# Mount manually
mount -t cifs //server/share /mnt -o user=username

# Auto mount
# /etc/fstab
//server/share /mnt cifs credentials=/root/.smbcredentials,iocharset=utf8 0 0

# Create credentials file
# /root/.smbcredentials
username=smbuser
password=password
domain=WORKGROUP

# Secure credentials
chmod 600 /root/.smbcredentials

# Test
smbclient -L //server -U username

Interview talking point: “storing credentials in /root/.smbcredentials referenced by fstab keeps the password off the command line, and chmod 600 ensures only root can read it, while smbclient -L lists available shares.”

Q156: How do you configure iSCSI target?

What it is: targetcli configures an iSCSI target interactively. It creates an iQN name, a block backstore backed by /dev/sdb, a LUN linking that backstore to the target, and an ACL naming the permitted client, then saves config.

Why it is used: To present a block device over the network so a remote host sees it as local storage.

# Target
targetcli
/> create iqn.2023-01.com.example:storage.lun0
/> /backstores/block create name=block1 dev=/dev/sdb
/> /iqn.2023-01.com.example:storage.lun0/luns create /backstores/block/block1
/> /iqn.2023-01.com.example:storage.lun0/acls create iqn.2023-01.com.example:client
/> saveconfig

Interview talking point: “The ACL restricts login to the named client IQN, so an initiator with a different IQN never sees the LUN even though the target is reachable.”

Q157: How do you configure iSCSI?

What it is: iSCSI mounts remote storage over the network as if it were a local disk. iscsiadm discovers targets, logs into one by IQN, sets node.startup to automatic, shows sessions with -m session -P 3, and logs out with -u.

Why it is used: To attach block storage from a SAN or storage array to a server that has no direct hardware path.

# Install initiator
apt install open-iscsi

# Discover targets
iscsiadm -m discovery -t st -p 192.168.1.100

# Login to target
iscsiadm -m node -T iqn.2023-01.com.example:storage.lun0 -l

# Make persistent
iscsiadm -m node -T iqn.2023-01.com.example:storage.lun0 -p 192.168.1.100 --op update -n node.startup -v automatic

# Check status
iscsiadm -m session -P 3

# Remove
iscsiadm -m node -T iqn.2023-01.com.example:storage.lun0 -u

Interview talking point: “Setting node.startup to automatic is what reconnects the session after a reboot, and iscsiadm -m session -P 3 reports current status so you can confirm the login actually succeeded.”

Q158: How do you configure iSCSI?

What it is: iSCSI presents a remote block device over the network. The initiator discovers targets with iscsiadm discovery, logs in to a named IQN, can be set to automatic startup, and the device is formatted like a local disk.

Why it is used: To attach network storage to a server as if it were a locally attached disk.

# Install (initiator)
apt install open-iscsi

# Discover targets
iscsiadm -m discovery -t st -p 192.168.1.10

# Login
iscsiadm -m node --targetname iqn.2010-01.com.example:storage.target1 --login

# Configure auto-login
iscsiadm -m node -p 192.168.1.10 -o update -n node.startup -v automatic

# View sessions
iscsiadm -m session
iscsiadm -m session -P 3

# Use device
fdisk -l /dev/sdb
mkfs.xfs /dev/sdb1

# Logout
iscsiadm -m node --targetname iqn.2010-01.com.example:storage.target1 --logout

Interview talking point: “After login the target appears as an ordinary disk you partition and format, and setting node startup to automatic is what makes the session reconnect after a reboot without manual intervention.”

Q159: How do you configure iscsiadm?

What it is: iscsiadm is the open-iscsi client tool that discovers targets, logs sessions in and out, and sets the node startup policy for iSCSI.

Why it is used: Connects a Linux host to remote block storage over the network without extra host bus hardware.

# Discover
iscsiadm -m discovery -t st -p 192.168.1.10

# Login
iscsiadm -m node -T iqn.name -p 192.168.1.10 -l

# Logout
iscsiadm -m node -T iqn.name -p 192.168.1.10 -u

# Auto-login
iscsiadm -m node -T iqn.name -p 192.168.1.10 --op update -n node.startup -v automatic

Interview talking point: “-m discovery with -t st lists the targets on a portal, -l brings a session up and -u drops it, while setting node.startup to automatic is the piece that makes the connection come back after a reboot.”

Q160: How do you configure NFS?

What it is: NFS exports a directory from a server so clients can mount it as a filesystem. The server adds a line to /etc/exports, runs exportfs -a, and the client mounts with mount -t nfs and records it in fstab.

Why it is used: To share files between Linux hosts so every node sees the same copy with standard permissions.

# Server side
# Install
apt install nfs-kernel-server

# Create export
mkdir -p /exports/shared
echo "/exports/shared 192.168.1.0/24(rw,sync,no_root_squash,no_all_squash)" >> /etc/exports

# Export
exportfs -a
systemctl restart nfs-kernel-server

# Client side
apt install nfs-common

# Mount
mount -t nfs 192.168.1.10:/exports/shared /mnt/nfs

# Persistent mount
echo "192.168.1.10:/exports/shared /mnt/nfs nfs defaults 0 0" >> /etc/fstab

Interview talking point: “The options inside the parentheses in /etc/exports matter: rw allows writes, sync writes synchronously, and exportfs -a applies the new export immediately; the client then persists the mount with an fstab line.”

Q161: How do you configure NFS?

What it is: NFS exports directories listed in exports files with options like rw, sync, and squash settings. exportfs applies the list, and clients mount the export locally or via an fstab entry marked for network wait.

Why it is used: To share directories between Linux machines so clients read and write them as local paths.

# Install
apt install nfs-kernel-server

/data 192.168.1.0/24(rw,sync,no_subtree_check,no_root_squash)
/backup 192.168.1.10(rw,sync,all_squash,anonuid=1000,anongid=1000)
*(ro,async,no_subtree_check)

# Export
exportfs -a
exportfs -r

# Client mount
mount -t nfs 192.168.1.10:/data /mnt/data

# /etc/fstab
192.168.1.10:/data /mnt/data nfs defaults,_netdev 0 0

# Options
# rw/sync - read-write/synchronous
# no_subtree_check - disable subtree checking
# no_root_squash - allow root access

Interview talking point: “no_root_squash lets client root own files as root while the default squashes it to an anonymous user, and sync means writes are confirmed to disk before the client is told they succeeded.”

Q162: How do you configure NFS?

What it is: NFS exports directories from /etc/exports with options like rw, sync and squash settings, applied by exportfs -a, then mounted on clients with mount -t nfs.

Why it is used: To share files across Linux hosts with native Unix permissions.

# Install server
apt install nfs-kernel-server

# Configure exports
# /etc/exports
/data 192.168.1.0/24(rw,sync,no_subtree_check,no_root_squash)
/backup 192.168.1.10(rw,sync,all_squash,anonuid=1000,anongid=1000)

# Export
exportfs -a

# Install client
apt install nfs-common

# Mount
mount -t nfs server:/data /mnt/data

# Auto mount
# /etc/fstab
server:/data /mnt/data nfs defaults,_netdev 0 0

# Verify
showmount -e server
mount | grep nfs

Interview talking point: “no_root_squash lets client root own files as root on the server, while all_squash with anonuid 1000 maps every writer to one uid, and _netdev in fstab delays mounting until the network is up.”

Q163: How do you configure NFSv4?

What it is: NFSv4 exports directories listed in /etc/exports with options such as rw, fsid=0, and no_subtree_check. Clients mount with mount -t nfs4, optionally adding Kerberos security like sec=krb5p.

Why it is used: To share filesystems across hosts, either trusting the network with sec=sys or authenticating with Kerberos.

# Server /etc/exports
/exports *(rw,sec=sys,fsid=0,no_subtree_check,no_root_squash)

# Client
mount -t nfs4 server:/ /mnt/nfs

# Or with Kerberos
# Server
/exports *(rw,sec=krb5p,fsid=0)

# Client
mount -t nfs4 -o sec=krb5 server:/ /mnt/nfs

Interview talking point: “With fsid=0 the export root is addressed as server:/, so the client mounts server:/ to /mnt/nfs. sec=sys relies on matching numeric UIDs while sec=krb5p adds Kerberos authentication and encryption for the traffic in transit.”

Q164: How do you configure NFSv4?

What it is: NFSv4 exports a directory tree across the network. The exports entry shares /exports read-write with sync, fsid 0, no subtree check, and no root squashing, while clients mount the server root with the nfs4 type or an fstab entry.

Why it is used: To share directories between Linux hosts so remote paths appear as ordinary local mounts.

# Server /etc/exports
/exports *(rw,sync,fsid=0,no_subtree_check,no_root_squash)

# Client
mount -t nfs4 server:/ /mnt/nfs

# Or in fstab
server:/ /mnt/nfs nfs4 defaults,_netdev 0 0

Interview talking point: “fsid 0 makes /exports the export root, so the client mounts server:/ instead of the full server path, and _netdev in fstab tells boot the mount needs the network.”

Q165: How do you configure SMB/CIFS?

What it is: Samba serves Windows-style shares and the cifs client mounts them on Linux. The record defines a [shared] share in smb.conf, creates a Samba user with smbpasswd, and mounts with mount -t cifs using a credentials file in fstab.

Why it is used: To share directories with Windows clients or consume an existing Windows share from a Linux host.

# Install
apt install cifs-utils samba

# Server config /etc/samba/smb.conf
[shared]
   path = /srv/samba/shared
   browseable = yes
   writable = yes
   valid users = @smbgroup

# Create user
smbpasswd -a username

# Client mount
mount -t cifs //server/share /mnt -o user=username,password=pass

# Persistent mount
# /etc/fstab
//server/share /mnt cifs credentials=/root/smb.creds 0 0

Interview talking point: “smbpasswd -a creates the account Samba authenticates against, and the credentials= option in fstab lets the mount persist without putting the password on the mount line.”

Q166: How do you configure targetcli?

What it is: targetcli is the interactive shell for the in-kernel LIO SCSI target: it creates backstores from block devices, iSCSI targets, LUNs, and ACLs, then saves the configuration.

Why it is used: Turns an ordinary Linux box into an iSCSI storage server for other hosts.

# Start
targetcli

# Create backstore
/backstores/block create name=block1 dev=/dev/sdb

# Create iSCSI target
/iscsi create iqn.2023-01.com.example:storage

# Create LUN
/iscsi/iqn.../tpg1/luns create /backstores/block/block1

# Create ACL
/iscsi/iqn.../tpg1/acls create iqn.2023-01.com.example:client

# Save
saveconfig
exit

Interview talking point: “The order matters: the backstore exposes the real device, the target names the portal, the LUN links them, and the ACL restricts which initiator IQN may connect; saveconfig is what persists all of it across restarts.”

Q167: How do you use iscsi scaling?

What it is: iSCSI scaling tunes session behavior in /etc/iscsi/iscsid.conf: connection limits, login retry limits, and per-connection MaxRecvDataSegmentLength control how sessions establish and how much they transfer.

Why it is used: Stabilizes many concurrent iSCSI sessions and raises throughput on high-latency or high-bandwidth links.

# Configure session
node.session.xpanding_max = 16
node.session.initial_login_retry_max = 8

# Create sessions
# Multiple connections
iscsiadm -m node -T iqn.name -p ip1 --op update -n node.conn[0].iscsi.MaxRecvDataSegmentLength=262144

Interview talking point: “MaxRecvDataSegmentLength caps the payload of a single iSCSI PDU, so raising it to 262144 lets each round trip carry more data, while initial_login_retry_max controls how hard the initiator retries after a target outage.”

Q168: How do you use NFS provisioner?

What it is: An NFS provisioner installed with helm dynamically creates NFS exports; the PVC uses storageClassName nfs and accessModes ReadWriteMany.

Why it is used: To share one volume among many pods across nodes at the same time.

# Install NFS provisioner
helm install nfs-server stable/nfs-server-provisioner

# Create PVC
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mypvc
spec:
  storageClassName: nfs
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi

Interview talking point: “ReadWriteMany is the reason to choose NFS, since most block storage classes only offer ReadWriteOnce on a single attaching node.”

Q169: How do you configure NFS security?

What it is: NFS exports are declared in /etc/exports with options controlling write access, syncing, and security flavor, then applied with exportfs -av.

Why it is used: To share files across hosts with access control and, optionally, encryption.

# Server configuration
/data 192.168.1.0/24(rw,sync,no_subtree_check,no_root_squash,sec=krb5p)
/secure 192.168.1.0/24(rw,sync,sec=sys)

# Kerberized NFS
# Server
# /etc/exports
/data gss/krb5p(rw,sync,no_subtree_check)

# Export
exportfs -av

# Client
mount -t nfs -o sec=krb5p server:/data /mnt

# Security options
# sec=sys - UID/GID mapping
# sec=krb5 - Authentication only
# sec=krb5i - Integrity
# sec=krb5p - Privacy

# Firewall
# Allow NFS
iptables -A INPUT -p tcp --dport 2049 -j ACCEPT
iptables -A INPUT -p udp --dport 2049 -j ACCEPT

# Test
nfsstat -c
showmount -e server

Interview talking point: “sec=sys trusts client-supplied UIDs, while sec=krb5p adds authentication, integrity, and privacy, so choose krb5p when traffic crosses an untrusted network.”

Level 9: Networking Fundamentals

IP Addressing and Subnetting

Q170: How do you configure IPv6?

What it is: IPv6 configuration uses the ip command with the -6 option: ip -6 addr show lists addresses, ip -6 addr add assigns a static address, and ip -6 route add installs a route. sysctl can disable IPv6 entirely.

Why it is used: To give a host IPv6 connectivity, verify it, or turn IPv6 off where the network does not use it.

# Check IPv6 status
ip -6 addr show
ping6 ipv6.google.com

# Static IPv6 address
ip -6 addr add 2001:db8::10/64 dev eth0

# Route IPv6
ip -6 route add 2001:db8:1::/48 via 2001:db8::1

# Disable IPv6
# sysctl.conf
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# Apply
sysctl -p

Interview talking point: “The same tools work with -6 instead of separate utilities: ping6 tests reachability, and setting net.ipv6.conf.all.disable_ipv6 and the default counterpart in sysctl.conf removes IPv6 from every interface after sysctl -p.”

Q171: How do you configure IPv6 security?

What it is: IPv6 can be disabled through sysctl or a kernel parameter, or firewalled with ip6tables rules that default to drop while allowing ICMPv6 and SSH.

Why it is used: To close an unmonitored protocol path, or to firewall IPv6 as strictly as IPv4.

# Disable IPv6
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1

# Or via GRUB
# GRUB_CMDLINE_LINUX="ipv6.disable=1"

# IPv6 firewall rules
ip6tables -F
ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT ACCEPT

# Allow established
ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow ICMPv6
ip6tables -A INPUT -p ipv6-icmp -j ACCEPT

# Allow SSH
ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT

# Block routing header
ip6tables -A INPUT -m rt --rt-type 0 -j DROP

# RA guard
# On switch or router
# Configure Router Advertisement filtering

Interview talking point: “ip6tables mirrors iptables, but ICMPv6 must be allowed for neighbor discovery and path MTU, so a blanket drop breaks connectivity even when IPv4 rules look fine.”

Interfaces and Link Layer

Q172: How do you check network configuration?

What it is: ip addr shows addresses, ip link shows interfaces, ip route shows the routing table, resolv.conf holds DNS servers, and dig or nslookup resolve names.

Why it is used: To verify addressing, routes, and name resolution when debugging a network problem.

# IP addresses
ip addr
ip link show

# Routing table
ip route
route -n

# DNS
cat /etc/resolv.conf
nslookup domain
dig domain

# Network interfaces
ifconfig
ip link

Interview talking point: “ip is the modern tool that replaces ifconfig and route, so ip addr and ip link cover what ifconfig used to print while ip route replaces route -n.”

Q173: How do you use ethtool advanced?

What it is: ethtool advanced options tune the NIC itself: -i shows driver info, -A sets rx and tx pause frames, -C sets interrupt coalescing, -L sets queue counts, and -K toggles offloads like tso, gso, gro.

Why it is used: Optimizes network throughput and latency, and isolates driver-level problems during troubleshooting.

# Show settings
ethtool -i eth0

# Pause
ethtool -A eth0 rx on tx on

# Coalesce
ethtool -C eth0 rx-usecs 100 tx-usecs 100

# Channels
ethtool -L eth0 combined 4

# Offloads
ethtool -K eth0 tso on gso on gro on

Interview talking point: “Switching offloads with -K is a classic debugging move, because checksum or segmentation symptoms often vanish once tso and gso are disabled, which points at the offload path rather than the fabric.”

Q174: How do you use ethtool?

What it is: ethtool shows and changes NIC settings: speed, duplex, autonegotiation, wake-on-LAN, driver info, ring buffer sizes, and offloads such as tso, gso, and gro.

Why it is used: To diagnose link problems and tune an interface at the driver level.

# Check settings
ethtool eth0

# Set speed/duplex
ethtool -s eth0 speed 1000 duplex full autoneg off

# Enable wake-on-LAN
ethtool -s eth0 wol g

# Check driver info
ethtool -i eth0

# Ring buffers
ethtool -G eth0 rx 4096 tx 4096

# Offloads
ethtool -K eth0 tso on gso on gro on

Interview talking point: “ethtool -i names the driver in use while -K toggles offloads, so switching off tso and gso is a quick isolation test when throughput or latency looks wrong.”

Q175: How do you configure tunnel interfaces?

What it is: Tunnel interfaces encapsulate traffic to traverse different networks, implemented as GRE, IPIP, or WireGuard VPN tunnels.

Why it is used: Securely connect remote sites or route traffic across untrusted intermediate networks.

# GRE tunnel
ip tunnel add gre0 mode gre remote 203.0.113.2 local 203.0.113.1
ip link set gre0 up
ip addr add 10.0.0.1/30 dev gre0

# IPIP tunnel
ip tunnel add ipip0 mode ipip remote 203.0.113.2 local 203.0.113.1
ip link set ipip0 up
ip addr add 10.0.0.1/30 dev ipip0

# WireGuard
apt install wireguard

# wg0.conf
[Interface]
PrivateKey = <server-private-key>
Address = 10.0.0.1/24
ListenPort = 51820

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32

wg-quick up wg0

Interview talking point: “WireGuard uses modern cryptography with minimal config, while GRE and IPIP provide simple IP-over-IP encapsulation.”

Routing and Gateways

Q176: How do you configure static routes?

What it is: A static route tells the kernel a fixed path to a network. ip route add installs a route or default gateway now, while route-eth0 on CentOS and an up ip route line in /etc/network/interfaces make it persistent.

Why it is used: To reach networks not covered by the default gateway, and to keep those routes after a reboot.

# Add temporary route
ip route add 192.168.100.0/24 via 192.168.1.1 dev eth0
ip route add default via 192.168.1.1

# Persistent routes (CentOS)
cat > /etc/sysconfig/network-scripts/route-eth0 <<EOF
192.168.100.0/24 via 192.168.1.1
EOF

# Persistent routes (Debian)
cat >> /etc/network/interfaces <<EOF
up ip route add 192.168.100.0/24 via 192.168.1.1
EOF

# View routes
ip route show
route -n

Interview talking point: “ip route add is temporary and disappears on reboot, so persistence needs either route-eth0 on CentOS or an up line in /etc/network/interfaces; ip route show and route -n then display the current routing table.”

Q177: How do you configure static routes?

What it is: A static route gives the kernel a fixed next hop for a network. ip route add does it at runtime, while interface files and route-eth0 make it survive a reboot.

Why it is used: To reach networks that the default gateway does not advertise.

# Temporary
ip route add 192.168.100.0/24 via 192.168.1.1 dev eth0

# Persistent (Debian)
# /etc/network/interfaces
up ip route add 192.168.100.0/24 via 192.168.1.1

# Persistent (CentOS)
cat > /etc/sysconfig/network-scripts/route-eth0 <<EOF
192.168.100.0/24 via 192.168.1.1
EOF

# Default route
ip route add default via 192.168.1.1

Interview talking point: “Routes added with ip route vanish on reboot, so Debian stores them in interfaces as up lines while CentOS uses route-eth0, and default via is just the zero destination prefix in shorthand.”

DNS Resolution (Client)

Q178: How do you configure DNS client?

What it is: The resolver reads nameserver and search lines from /etc/resolv.conf. systemd-resolved offers resolvectl status and per-link DNS overrides, while dhclient can supersede servers handed out by DHCP.

Why it is used: To control which DNS servers a host queries and which search domains get appended.

nameserver 8.8.8.8
nameserver 8.8.4.4
search example.com

# Using systemd-resolved
systemctl enable systemd-resolved
systemctl start systemd-resolved
resolvectl status

# Override DNS per interface
# /etc/systemd/resolved.conf.d/dns.conf
[Resolve]
DNS=1.1.1.1
Domains=example.com

# Using dhclient
# /etc/dhcp/dhclient.conf
supersede domain-name-servers 8.8.8.8, 8.8.4.4;

Interview talking point: “supersede domain-name-servers in dhclient.conf stops the DHCP lease from overwriting your chosen resolvers, which is the usual reason DNS settings quietly revert after a lease renewal.”

Q179: How do you use dig for DNS queries?

What it is: dig queries DNS servers: a bare name returns the default record, A, MX, and NS select record types, -x performs a reverse lookup, +trace follows delegation, and @server picks the resolver.

Why it is used: Verifying records and debugging name resolution end to end.

# Basic query
dig example.com

# Query specific record
dig A example.com
dig MX example.com
dig NS example.com

# Reverse lookup
dig -x 192.168.1.1

# Trace
dig +trace example.com

# Query specific server
dig @8.8.8.8 example.com

Interview talking point: “dig @8.8.8.8 bypasses your local resolver, so comparing it with a plain dig tells you whether the fault lies in local configuration or in the published record itself.”

TCP, UDP, Ports, and Sockets

Q180: How do you use Port?

What it is: The Port CLI checks whether a local port is free, registers a GitHub repository as an integration, and creates a catalog entity from a blueprint.

Why it is used: Populates the Port developer portal catalog with services and their sources.

# Install
port check --port 3003

# Add integration
port integrate github --owner myorg --repo myrepo

# Create entity
port create entity --blueprint myblueprint --identifier myentity

Interview talking point: “The entity is created against a blueprint, so the blueprint defines the schema first and each entity is an instance of it, like a table holding rows.”

Connectivity Testing

Q181: How do you test network connectivity?

What it is: ping tests reachability, traceroute and tracepath map the path, nc -zv scans port ranges, telnet probes one port, and nslookup, dig, host perform DNS lookups.

Why it is used: To separate a routing problem from a DNS problem or a blocked port.

# Ping
ping -c 4 host
ping -i 0.5 host  # interval

# Traceroute
traceroute host
tracepath host

# Port scanning
nc -zv host 1-1000
telnet host port

# DNS lookup
nslookup domain
dig domain
host domain

Interview talking point: “ping -c 4 stops after four packets instead of running forever, dig returns full DNS record detail, and nc -zv tells you whether a port actually accepts connections.”

Q182: How do you use curl effectively?

What it is: curl transfers data to or from a URL. The examples show a GET, a JSON POST with headers, downloading with -O -L, basic auth with -u, following redirects, and reading and writing cookies.

Why it is used: To test APIs and HTTP endpoints, download files, and reproduce requests from the command line during troubleshooting.

# Basic GET
curl https://api.example.com

# POST with JSON
curl -X POST -H "Content-Type: application/json" \
  -d '{"key":"value"}' https://api.example.com

# Download with progress
curl -O -L https://example.com/file.zip

# With authentication
curl -u user:password https://api.example.com

# Follow redirects
curl -L https://example.com

# With cookie
curl -b cookies.txt -c cookies.txt https://example.com

Interview talking point: “Two flags matter most: -L follows redirects so a URL that bounces does not silently return an empty body, and -O keeps the remote filename while -d sends a body with -X POST and a Content-Type header.”

Q183: How do you use hping3?

What it is: hping3 crafts packets: -1 sends ICMP echo, -S sends SYN flags, -8 scans a port range, -t sets TTL, and -E attaches file contents to a packet.

Why it is used: To craft probe packets for firewall testing, path tracing, and stress checks.

# Install
apt install hping3

# Ping
hping3 -1 192.168.1.1

# SYN flood
hping3 -S 192.168.1.1 -p 80 --flood

# Port scan
hping3 -8 1-1000 -S 192.168.1.1

# Trace
hping3 -t 1 -z 192.168.1.1

# Custom packet
hping3 -c 1 -1 -p 80 -E data.txt 192.168.1.1

Interview talking point: “—flood combined with -S sends SYNs as fast as possible with no replies, which is useful for validating defenses and must only ever target systems you own.”

Q184: How do you use netcat?

What it is: netcat opens connections for port scanning with -zv, simple listeners with -l and -p, file transfer through redirection, chat, and a shell relay with -e.

Why it is used: To test ports, move files quickly, or probe services without dedicated tools.

# Port scanning
nc -zv 192.168.1.1 1-1000

# Simple server
nc -l -p 1234

# Simple client
nc 192.168.1.1 1234

# File transfer
# Server
nc -l -p 1234 < file.txt
# Client
nc 192.168.1.1 1234 > file.txt

# Reverse shell
# Server (attacker)
nc -l -p 1234

# Client (victim)
nc -e /bin/bash 192.168.1.1 1234

# Chat
nc -l -p 1234
nc 192.168.1.1 1234

Interview talking point: “-zv scans without sending payload so it is a quick safe port sweep, while the -e option that spawns a shell is exactly why netcat draws scrutiny in audits.”

Q185: How do you use wget effectively?

What it is: wget fetches files from a URL. It shows a plain download, recursion with -r, resuming an interrupted transfer with -c, mirroring a site with -m -k -p, login credentials, and a bandwidth cap with —limit-rate.

Why it is used: For scripted or bulk downloads where you need resume, mirroring, or rate limiting rather than interactive browsing.

# Download file
wget https://example.com/file.zip

# Download recursively
wget -r https://example.com/

# Continue download
wget -c https://example.com/largefile.zip

# Mirror site
wget -m -k -p https://example.com

# Download with credentials
wget --user=user --password=pass https://example.com

# Limit bandwidth
wget --limit-rate=100k https://example.com/file.zip

Interview talking point: “The comments mark the key switches: -c resumes an interrupted download instead of restarting, -m mirrors the site, and —limit-rate keeps a background download from starving other traffic.”

Q186: How do you test network performance?

What it is: Network performance testing with iperf throughput streams, fping sweeps, path MTU discovery via tracepath, latency probes with sockperf, and simple netcat transfers.

Why it is used: To measure achievable bandwidth and latency and find MTU or path problems.

# iperf server
iperf -s

# iperf client
iperf -c server-ip
iperf -c server-ip -P 4
iperf -c server-ip -M 1400
iperf -c server-ip -t 60

# iperf3
iperf3 -s
iperf3 -c server-ip
iperf3 -c server-ip -R # reverse
iperf3 -c server-ip -P 8 # parallel

# Network speed test
speedtest-cli

# Ping test
fping -g 192.168.1.0/24
ping -M do -s 1400 host

# Latency test
sockperf ping-pong --tcp -i server -p 12345

# MTU discovery
tracepath server

# Netcat throughput
nc -l -p 9000 > /dev/null &
nc -N server 9000 < /dev/zero

Interview talking point: “iperf3 -R runs the stream in reverse so you measure the download direction separately, and ping -M do with a large size verifies the path MTU end to end.”

Level 10: Network Services

SSH

Q187: How do you configure rsync over SSH?

What it is: rsync -avz transfers a tree over the ssh transport instead of the rsync daemon, with -e selecting options like a key file, sshpass for a password, or a custom port.

Why it is used: Mirroring directories to remote hosts efficiently, sending only changed files on each run.

# With SSH key
rsync -avz -e "ssh -i /path/to/key" source/ user@server:/dest/

# With password
rsync -avz -e "sshpass -p password ssh" source/ user@server:/dest/

# With specific port
rsync -avz -e "ssh -p 2222" source/ user@server:/dest/

Interview talking point: “The -e flag takes the whole remote shell command, so -e “ssh -p 2222” sets the port, and the trailing slash on source/ decides between copying the contents of a directory and copying the directory itself.”

Q188: How do you configure SSH agent forwarding?

What it is: Starting ssh-agent in a shell, loading a private key with ssh-add, then enabling ForwardAgent yes in ssh config or using ssh -A so the remote host can use the loaded key.

Why it is used: Reach the next host through a jump box without copying private keys onto intermediate servers.

# Start agent
ssh-agent bash

# Add key
ssh-add

# Forward agent
# ~/.ssh/config
Host server
    ForwardAgent yes

# Use
ssh -A user@server

Interview talking point: “ForwardAgent exposes your agent to the remote machine, so that host can use your key during the session, which is the classic trade-off against placing private keys on intermediate boxes.”

Q189: How do you set up SSH key management?

What it is: Generating an ed25519 key pair with ssh-keygen, pushing the public key with ssh-copy-id, then restricting it in authorized_keys using from= source matching and command= forced commands.

Why it is used: Passwordless, auditable login and tightly scoped access for automation or a single Git operation.

# Generate key
ssh-keygen -t ed25519 -C "user@host"

# Copy to server
ssh-copy-id user@server

# Restrict keys
# ~/.ssh/authorized_keys
from="192.168.1.10",command="/bin/ls" ssh-ed25519 AAAA...

# Force command
command="git-shell" ssh-ed25519 AAAA...

Interview talking point: “The command= option forces any session using that key to run only that command, so a key issued for git-shell cannot be used to open an interactive shell.”

Q190: How do you use rsync for backups?

What it is: rsync copies and synchronizes directory trees with archive, verbose, and compress options, supporting deletion of extras, exclusion patterns, dry runs, and progress reporting.

Why it is used: To mirror data to a backup location efficiently by transferring only differences.

# Basic sync
rsync -avz /source/ /destination/

# With deletion
rsync -avz --delete /source/ /destination/

# Exclude patterns
rsync -avz --exclude='*.log' --exclude='tmp/' /source/ /destination/

# Compress during transfer
rsync -avz --compress /source/ /destination/

# Dry run
rsync -avzn /source/ /destination/

# With progress
rsync -avz --progress /source/ /destination/

# Backup script
#!/bin/bash
rsync -avz --delete --exclude-from='/etc/rsync-exclude.txt \
  /data/ /backup/data-$(date +%Y%m%d)/
find /backup -type d -mtime +30 -exec rm -rf {} \;

Interview talking point: “Adding n as the option makes it a dry run that lists pending changes without writing, and —delete turns the destination into an exact mirror by removing extra files.”

Q191: How do you use rsync for backups?

What it is: rsync copies and synchronizes directory trees, transferring only the differences between source and destination. Options add archive mode, compression over ssh, deletion of extra files, excludes, bandwidth limits, and a dry run.

Why it is used: To keep a backup mirror current without retransferring unchanged files on every run.

# Basic sync
rsync -av /source/ /destination/
rsync -avz -e ssh user@remote:/remote/ /local/

# Delete files not in source
rsync -av --delete /source/ /destination/

# Exclude patterns
rsync -av --exclude='*.log' --exclude='tmp/' /source/ /destination/

# Progress and bandwidth
rsync -av --progress --bwlimit=1000 /source/ /destination/

# Dry run
rsync -avn /source/ /destination/

# Script for automated backup
#!/bin/bash
rsync -avz --delete -e ssh /data/ backup@server:/backup/$(date +%Y%m%d)/

Interview talking point: “The trailing slash on a source matters: with it you copy the directory contents, without it you copy the directory itself, and the n flag lets you preview exactly what a delete sync would remove.”

Q192: How do you use rsync?

What it is: rsync mirrors a directory tree with -avz; the n flag makes a dry run, —delete removes files missing from the source, —exclude skips patterns, and —progress reports transfers.

Why it is used: Efficient incremental replication for backups and site mirroring.

# Basic sync
rsync -avz source/ destination/

# Dry run
rsync -avzn source/ destination/

# Delete files not in source
rsync -avz --delete source/ destination/

# Exclude patterns
rsync -avz --exclude='*.log' source/ destination/

# Progress
rsync -avz --progress source/ destination/

Interview talking point: “rsync -avzn previews changes without writing anything, so pair it with —delete before a real run, since —delete will remove destination files that no longer exist at the source.”

Q193: How do you use rsync?

What it is: rsync copies and synchronizes directory trees incrementally. The commands mirror a tree with archive, verbose, and compression, optionally delete extra files, exclude patterns, show transfer progress, and dry-run with the n flag.

Why it is used: To replicate files between hosts or directories efficiently by transferring only the differences.

# Basic sync
rsync -avz source/ destination/

# With delete
rsync -avz --delete source/ destination/

# Exclude
rsync -avz --exclude='*.log' --exclude='tmp/' source/ destination/

# Compress
rsync -avz --compress source/ destination/

# Progress
rsync -avz --progress source/ destination/

# Dry run
rsync -avzn source/ destination/

Interview talking point: “The trailing n in -avzn makes it a dry run that lists what would change without writing anything, which is worth doing before adding —delete, since —delete removes files missing from the source.”

Q194: How do you use scp with key?

What it is: scp copies files over SSH, here with -i pointing at an identity file, -c choosing a cipher, -r recursing into directories, and -C turning on compression.

Why it is used: Moving files to servers when you want a straightforward copy rather than a synchronizing tool.

# With identity file
scp -i /path/to/key file user@server:/path/

# With specific cipher
scp -c aes256-gcm@openssh.com file user@server:/path/

# Recursive
scp -r directory/ user@server:/path/

# With compression
scp -C file user@server:/path/

Interview talking point: “scp -i avoids the password prompt and -C helps on slow links, but these options apply to a single transfer, so there is no incremental diff the way rsync repeats runs.”

Q195: How do you use SSH key authentication?

What it is: ssh-keygen creates an RSA 4096-bit or ed25519 key pair, ssh-copy-id installs the public key on the server, and the ssh config file defines aliases with HostName, User, and IdentityFile.

Why it is used: To log in without typing a password and simplify repeated connections to many hosts.

# Generate key
ssh-keygen -t rsa -b 4096
ssh-keygen -t ed25519

# Copy to server
ssh-copy-id user@host
# or
ssh user@host 'mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys' < ~/.ssh/id_rsa.pub

# SSH config
cat ~/.ssh/config
Host server
    HostName 192.168.1.10
    User admin
    IdentityFile ~/.ssh/id_rsa

Interview talking point: “the manual path appends the public key into the server’s authorized_keys file yourself while ssh-copy-id does it for you, and a Host alias in the config makes ssh server expand to full address and user.”

Q196: How do you set up SSH tunnel?

What it is: ssh -L forwards a local port to a remote destination, -R exposes a remote port back to the client, -D opens a SOCKS proxy, and ServerAliveInterval keeps the connection alive.

Why it is used: Reaching internal services behind a firewall or browsing through an encrypted proxy without extra daemons.

# Local port forward
ssh -L 8080:localhost:80 user@server

# Remote port forward
ssh -R 8080:localhost:80 user@server

# Dynamic SOCKS proxy
ssh -D 8080 user@server

# Keep alive
ssh -o ServerAliveInterval=60 user@server

Interview talking point: “The direction is the thing to remember: -L listens locally and reaches past the server into its network, -R listens on the server and pulls back to you, while -D makes SSH a general SOCKS proxy.”

Web Servers

Q197: How do you load test web servers?

What it is: Web load testing tools: ab and wrk for concurrent request rates, siege for scripted sessions, JMeter in CLI mode, and k6 driven by a JavaScript scenario.

Why it is used: To find request-per-second limits and latency behavior before real users arrive.

# Apache Bench (ab)
ab -n 10000 -c 100 http://localhost/index.html
ab -n 1000 -c 10 -t 60 http://localhost/api

# wrk
wrk -t4 -c100 -d30s http://localhost/
wrk -t2 -c50 -d30s --latency http://localhost/

# Custom script
wrk.method = "POST"
wrk.body   = '{"data":"test"}'
wrk.headers["Content-Type"] = "application/json"

# siege
siege -c100 -r100 http://localhost/
siege -b -t5M http://localhost/

# Apache JMeter
# GUI
jmeter

# CLI
jmeter -n -t test.jmx -l results.jtl

# k6
# test.js
import http from 'k6/http';
import { check, sleep } from 'k6';

export const options = {
  vus: 10,
  duration: '30s',
};

export default function() {
  const res = http.get('http://localhost/');
  check(res, { 'status is 200': r => r.status === 200 });
  sleep(1);
}

Interview talking point: “ab -n sets total requests while -c sets concurrency, and wrk with —latency reports a latency distribution instead of a single average that hides slow tails.”

Q198: How do you configure Apache advanced?

What it is: Apache virtual hosts combine TLS certificate directives, directory options, security headers, keep-alive tuning, and compression, and can proxy to a balancer cluster.

Why it is used: To serve sites securely over HTTPS and to spread requests across backend nodes.

# Virtual host with SSL
<VirtualHost *:443>
    ServerName example.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/server.crt
    SSLCertificateKeyFile /etc/ssl/private/server.key
    SSLCertificateChainFile /etc/ssl/certs/ca.crt

    <Directory /var/www/html>
        Options -Indexes +FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>

    # Security headers
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"

    # Performance
    KeepAlive On
    MaxKeepAliveRequests 100
    KeepAliveTimeout 5

    # Compression
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript
</VirtualHost>

# Load balancer
<Proxy balancer://mycluster>
    BalancerMember http://192.168.1.10:8080 route=node1
    BalancerMember http://192.168.1.11:8080 route=node2
    ProxySet lbmethod=byrequests
</Proxy>

ProxyPass / balancer://mycluster/
ProxyPassReverse / balancer://mycluster/

Interview talking point: “Options -Indexes stops directory listings being served when no index file exists, while balancer members let Apache distribute requests by request count across backends.”

Q199: How do you configure Apache?

What it is: apache2.conf sets ServerRoot and Listen, loads modules such as mpm_prefork, includes module, port, conf, and site files, and a VirtualHost block maps a ServerName to a document root with logs.

Why it is used: Hosting multiple sites on one Apache instance and enabling modules selectively.

ServerRoot "/etc/apache2"
Listen 80

LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
LoadModule authz_core_module modules/mod_authz_core.so

IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf
Include ports.conf
IncludeOptional conf-enabled/*.conf
IncludeOptional sites-enabled/*.conf

# Virtual host
<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/html
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Interview talking point: “The VirtualHost with ServerName example.com is how one server answers for many domains, since the incoming Host header selects the block, and IncludeOptional sites-enabled keeps each site in its own file.”

Q200: How do you configure Apache?

What it is: Apache virtual hosts let one instance serve several sites. The VirtualHost block sets ServerName, DocumentRoot, directory options, and log paths; a2ensite enables the config and systemctl reload applies it.

Why it is used: To host multiple domains on one server and control per-site directory behavior and logs.

# Install
apt install apache2

# Virtual host
<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/html

    <Directory /var/www/html>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

# Enable
a2ensite example.conf
systemctl reload apache2

Interview talking point: “Options -Indexes disables directory listing while +FollowSymLinks allows symlink following, and AllowOverride All lets .htaccess files apply. Reloading Apache picks up new vhost config without dropping live connections, unlike a full restart.”

Q201: How do you configure Apache?

What it is: Apache installs as apache2 on Debian or httpd on RHEL, configured by apache2.conf or httpd.conf, with virtual hosts declaring ServerName, DocumentRoot, and log paths.

Why it is used: To serve multiple sites from one server and enable modules such as SSL or rewrite.

# Install
apt install apache2
# or
yum install httpd

# Configuration
# /etc/apache2/apache2.conf (Debian)
# /etc/httpd/conf/httpd.conf (RHEL)

# Virtual hosts
# /etc/apache2/sites-available/example.conf
<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/html
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

# Enable site
a2ensite example
systemctl reload apache2

# Modules
a2enmod ssl rewrite proxy

Interview talking point: “a2ensite and a2enmod enable a site or module but only take effect after systemctl reload apache2, and the site file lives under sites-available until enabled. The Debian and RHEL config paths differ.”

Q202: How do you configure Nginx advanced?

What it is: Nginx tuning covers worker process counts, connection limits, log formats, file caching, and an upstream block with least_conn balancing and keepalive toward backends.

Why it is used: To raise throughput and keep backend connections pooled under heavy load.

# Worker configuration
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 65535;
    use epoll;
    multi_accept on;
}

http {
    # Logging
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;
    error_log /var/log/nginx/error.log warn;

    # Performance
    open_file_cache max=10000 inactive=30s;
    open_file_cache_valid 60s;
    open_file_cache_min_uses 2;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;

    # Upstream with health check
    upstream backend {
        least_conn;
        server 192.168.1.10:8080 max_fails=3 fail_timeout=30s;
        server 192.168.1.11:8080 max_fails=3 fail_timeout=30s;
        keepalive 32;
    }

    server {
        location / {
            proxy_pass http://backend;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }
    }
}

Interview talking point: “proxy_http_version 1.1 with an empty Connection header is what makes upstream keepalive work, so pooled backend connections are actually reused between requests.”

Q203: How do you configure Nginx with HTTP/2?

What it is: Nginx can be configured to serve HTTPS with HTTP/2 enabled on port 443 using SSL certificates.

Why it is used: Improve web performance through HTTP/2 multiplexing while maintaining secure transport.

# Install nginx-extras for HTTP/2
apt install nginx-extras

http {
    # HTTP/2 settings
    server {
        listen 443 ssl http2;
        server_name example.com;

        ssl_certificate /etc/ssl/certs/server.crt;
        ssl_certificate_key /etc/ssl/private/server.key;

        # SSL configuration
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
        ssl_prefer_server_ciphers off;

        # OCSP stapling
        ssl_stapling on;
        ssl_stapling_verify on;

        location / {
            proxy_pass http://backend;
        }
    }
}

Interview talking point: “HTTP/2 requires TLS; OCSP stapling reduces client validation latency by serving pre-fetched certificate status responses.”

Q204: How do you configure Nginx?

What it is: nginx.conf sets worker_processes and worker_rlimit_nofile, an events block using epoll with worker_connections, and an http block defining the log format, access and error logs, and included config files.

Why it is used: Tuning web server capacity and standardizing access logging.

worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 4096;
    use epoll;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;
    error_log /var/log/nginx/error.log;

    include /etc/nginx/conf.d/*.conf;
}

Interview talking point: “worker_processes auto with worker_connections 4096 sets concurrency, and include /etc/nginx/conf.d/*.conf means individual site definitions stay in separate files instead of crowding the main configuration.”

Q205: How do you configure Nginx?

What it is: An Nginx server block defines a site: listen port, server_name, root, and location blocks. Here try_files serves static files and the regex location for PHP files passes scripts to a php-fpm Unix socket over FastCGI.

Why it is used: To serve web content while handing dynamic requests off to an application backend.

# Install
apt install nginx

# Server block
server {
    listen 80;
    server_name example.com;

    root /var/www/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    ssl_certificate /etc/ssl/certs/server.crt;
    ssl_certificate_key /etc/ssl/private/server.key;
}

Interview talking point: “The PHP location forwards to a php-fpm Unix socket, so Nginx itself only handles static assets. try_files falls back to a 404 rather than exposing missing paths, and the same block carries the certificate and key paths for TLS.”

Q206: How do you configure Nginx?

What it is: Nginx is configured by server blocks with listen, server_name, root, and location sections, where a location either serves files or proxies to a backend.

Why it is used: To host sites and reverse proxy application ports from one web server.

# Install
apt install nginx
# or
yum install nginx

# Configuration
# /etc/nginx/nginx.conf

# Server block
# /etc/nginx/sites-available/default
server {
    listen 80;
    server_name example.com;

    root /var/www/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }

    location /api {
        proxy_pass http://localhost:3000;
    }
}

# Test config
nginx -t

# Reload
systemctl reload nginx

Interview talking point: “nginx -t validates configuration before systemctl reload nginx, so a syntax error is caught before a reload drops traffic. try_files looks for a real file and returns 404, while location /api proxies to the backend.”

Q207: How do you configure web server tuning?

What it is: Web server tuning: Apache mpm_prefork limits like MaxRequestWorkers control worker processes, while Nginx settings raise worker_connections, enable sendfile, tcp_nopush, and keepalive, add open_file_cache, and compress responses with gzip.

Why it is used: To handle more concurrent connections with less CPU and I/O overhead.

# Apache tuning
<IfModule mpm_prefork_module>
    StartServers             5
    MinSpareServers          5
    MaxSpareServers         10
    MaxRequestWorkers      150
    MaxConnectionsPerChild   0
</IfModule>

# Nginx tuning
# /etc/nginx/nginx.conf
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 65535;
    multi_accept on;
    use epoll;
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    keepalive_requests 1000;

    open_file_cache max=10000 inactive=30s;
    open_file_cache_valid 60s;
    open_file_cache_min_uses 2;

    gzip on;
    gzip_types text/plain text/css application/json application/javascript;
}

Interview talking point: “gzip on with a gzip_types list compresses text, CSS, JSON, and JavaScript while leaving other types alone, and that selective list is where the bandwidth savings come from.”

Q208: How do you optimize web server performance?

What it is: Nginx is tuned for high concurrency using worker processes, epoll event handling, and optimized buffers.

Why it is used: Reduce response latency and handle large numbers of simultaneous connections efficiently.

# Nginx optimization
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 65535;
    use epoll;
    multi_accept on;
}

http {
    # Buffer sizes
    client_body_buffer_size 10K;
    client_header_buffer_size 1k;
    client_max_body_size 8m;
    large_client_header_buffers 4 32k;

    # Caching
    open_file_cache max=10000 inactive=30s;
    open_file_cache_valid 60s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;

    # Gzip
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml application/json application/javascript;
}

Interview talking point: “Combining epoll with appropriate worker_connections and open_file_cache maximizes throughput on Linux systems.”

Reverse Proxy and Load Balancing

Q209: How do?

What it is: Linux Virtual Server load balances traffic in the kernel; ipvsadm creates a virtual service with round-robin scheduling and adds real servers in masquerade mode.

Why it is used: To spread incoming TCP load across backend servers at very low overhead.

# LVS (Linux Virtual Server)
# Install
apt install ipvsadm

# Configure
ipvsadm -A -t 192.168.1.100:80 -s rr
ipvsadm -a -t 192.168.1.100:80 -r 192.168.1.10:80 -m
ipvsadm -a -t 192.168.1.100:80 -r 192.168.1.11:80 -m

# View
ipvsadm -l -n
ipvsadm -l -n --stats

# Persistence
ipvsadm -A -t 192.168.1.100:80 -s rr -p 300

# Weight adjustment
ipvsadm -e -t 192.168.1.100:80 -r 192.168.1.10:80 -m -w 2

Interview talking point: “The -p flag sets connection persistence so the same client stays on the same backend for 300 seconds, and -e adjusts a server weight without recreating the service.”

Q210: How do you configure HAProxy with SSL?

What it is: HAProxy terminates TLS using a combined PEM certificate and serves HTTPS on the frontend.

Why it is used: Offload TLS processing and load balance traffic to backend servers with health checks.

# Generate certificates
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/ssl/private/haproxy.key \
  -out /etc/ssl/certs/haproxy.crt

# Combine to PEM
cat /etc/ssl/certs/haproxy.crt /etc/ssl/private/haproxy.key > /etc/haproxy/haproxy.pem

# HAProxy config
# /etc/haproxy/haproxy.cfg
frontend https_front
    bind *:443 ssl crt /etc/haproxy/haproxy.pem
    http-response set Strict-Transport-Security "max-age=31536000"
    default_backend app_servers

backend app_servers
    balance roundrobin
    option httpchk GET /health
    http-check expect status 200
    server app1 192.168.1.10:8080 check inter 2000 rise 2 fall 3
    server app2 192.168.1.11:8080 check inter 2000 rise 2 fall 3

# OCSP stapling
frontend https_front
    bind *:443 ssl crt /etc/haproxy/haproxy.pem ocsp-int ca-file /etc/ssl/certs/ca-certificates.crt

Interview talking point: “Terminating TLS at the proxy centralizes certificate management; health checks prevent routing traffic to unhealthy backends.”

Q211: How do you configure HAProxy?

What it is: HAProxy is a load balancer. haproxy.cfg has a frontend binding port 80 to a backend of two checked servers with roundrobin balancing, plus global limits, logging, timeouts, and retry behavior.

Why it is used: To spread web traffic across backend servers and keep serving when one backend fails.

# Install
apt install haproxy

global
    log /dev/log local0
    maxconn 4000
    user haproxy
    group haproxy

defaults
    log global
    mode http
    option httplog
    option dontlognull
    option http-server-close
    option forwardfor except 127.0.0.0/8
    option redispatch
    retries 3
    timeout connect 5000
    timeout client 50000
    timeout server 50000

frontend http-in
    bind *:80
    default_backend servers

backend servers
    balance roundrobin
    server web1 192.168.1.10:80 check
    server web2 192.168.1.11:80 check

Interview talking point: “The frontend and backend split is the core idea: the frontend only binds and routes, while health checks, retries and the roundrobin balance live on the backend, and redispatch moves a request to another server after a failed connect.”

Q212: How do you configure HAProxy?

What it is: HAProxy is a load balancer. haproxy.cfg defines a frontend binding port 80, a backend with roundrobin balancing across two health-checked servers, plus a stats listener on port 8404.

Why it is used: To distribute traffic across backend servers and health-check them so failed nodes are skipped.

# Install
apt install haproxy

global
    log /dev/log local0
    maxconn 4000
    user haproxy
    group haproxy

defaults
    log global
    mode http
    option httplog
    option dontlognull

frontend http-in
    bind *:80
    default_backend servers

backend servers
    balance roundrobin
    server s1 192.168.1.10:80 check
    server s2 192.168.1.11:80 check

# Enable stats
listen stats
    bind *:8404
    stats enable
    stats uri /stats

Interview talking point: “The check keyword on each server makes HAProxy probe backends and stop routing to ones that fail. balance roundrobin spreads requests evenly, and the separate listen stats section exposes a live statistics page for watching backend health.”

Q213: How do you configure HAProxy?

What it is: HAProxy is a load balancer configured in global, defaults, frontend, and backend sections. The frontend binds port 80 and forwards to a backend that distributes requests round robin across checked servers, with one marked backup.

Why it is used: To spread traffic across app servers and fail over to a spare when primaries are down.

# Install
apt install haproxy

global
    log /dev/log local0
    maxconn 4096
    user haproxy
    group haproxy

defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    option  redispatch
    retries 3
    timeout connect 5000
    timeout client  50000
    timeout server  50000

frontend http-in
    bind *:80
    default_backend app-servers

backend app-servers
    balance roundrobin
    server app1 192.168.1.10:8080 check
    server app2 192.168.1.11:8080 check
    server app3 192.168.1.12:8080 check backup

Interview talking point: “The check keyword enables health checks so dead servers leave rotation, and the server marked backup only receives traffic when the others are unavailable, which makes it a cheap standby.”

Q214: How do you configure HAProxy?

What it is: The HAProxy config defines global limits, defaults, a frontend binding port 80, and a backend that round-robins across two health-checked application servers.

Why it is used: To distribute HTTP traffic across app servers and pull failed ones out automatically.

# Install
apt install haproxy

# Configure
# /etc/haproxy/haproxy.cfg
global
    log /dev/log local0
    maxconn 4096
    user haproxy
    group haproxy

defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull

frontend http_front
    bind *:80
    default_backend app_servers

backend app_servers
    balance roundrobin
    option httpchk GET /health
    server app1 192.168.1.10:8080 check inter 2000 fall 3 rise 2
    server app2 192.168.1.11:8080 check inter 2000 fall 3 rise 2

Interview talking point: “The backend check is option httpchk GET /health with inter 2000 fall 3 rise 2, so a server leaves rotation after 3 failed probes and returns only after 2 good ones.”

Q215: How do you configure load balancer in cloud?

What it is: Creating an AWS Application Load Balancer with the CLI: create the balancer across subnets, create an HTTP target group on port 80, register instances, and add a listener that forwards to the target group.

Why it is used: To distribute traffic across instances and keep an endpoint available.

# AWS Application Load Balancer
aws elbv2 create-load-balancer \
  --name my-alb \
  --subnets subnet-12345678 subnet-87654321 \
  --security-groups sg-12345678

# Target group
aws elv2 create-target-group \
  --name my-targets \
  --protocol HTTP \
  --port 80 \
  --vpc vpc-12345678

# Register targets
aws elv2 register-targets \
  --target-group-arn arn:aws:elasticloadbalancing:... \
  --targets Id=i-12345678

# Listener
aws elv2 create-listener \
  --load-balancer-arn arn:aws:elasticloadbalancing:... \
  --protocol HTTP \
  --port 80 \
  --default-actions Type=forward,TargetGroupArn=arn:aws:...

# HAProxy load balancer (on-premise)
# See HAProxy configuration earlier

Interview talking point: “The listener default action is what connects a load balancer to a target group; without registering targets the balancer exists but has no backends to receive traffic.”

Q216: How do you configure load balancer?

What it is: MetalLB gives bare-metal clusters LoadBalancer services by handing out addresses from a configured pool. This example uses layer2 mode with the range 192.168.1.240-192.168.1.250.

Why it is used: To provide external IPs for services where no cloud provider supplies a load balancer.

# MetalLB
apiVersion: v1
kind: ConfigMap
metadata:
  namespace: metallb-system
  name: config
data:
  config: |
    address-pools:
    - name: default
      protocol: layer2
      addresses:
      - 192.168.1.240-192.168.1.250

# Service
apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  type: LoadBalancer
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 80

Interview talking point: “layer2 mode announces addresses from a pool on the local network, so the whole range must be unused and routable or services never get a working external IP.”

Q217: How do you configure load balancing algorithms?

What it is: HAProxy balancing algorithms: roundrobin spreads requests evenly, leastconn picks the server with fewest open connections, source hashes the client IP, uri hashes the request path, and weight biases roundrobin toward stronger servers.

Why it is used: To match traffic distribution to the workload’s connection pattern.

# HAProxy algorithms
# Round Robin (default)
backend servers
    balance roundrobin
    server s1 192.168.1.10:80 check
    server s2 192.168.1.11:80 check

# Least Connections
backend servers
    balance leastconn
    server s1 192.168.1.10:80 check
    server s2 192.168.1.11:80 check

# Source IP Hash
backend servers
    balance source
    server s1 192.168.1.10:80 check
    server s2 192.168.1.11:80 check

# URI Hash
backend servers
    balance uri
    server s1 192.168.1.10:80 check
    server s2 192.168.1.11:80 check

# Weighted
backend servers
    balance roundrobin
    server s1 192.168.1.10:80 weight 3 check
    server s2 192.168.1.11:80 weight 1 check

Interview talking point: “leastconn suits long-lived or variable-length connections because roundrobin ignores how busy a server is, while source gives stickiness when sessions must land on the same backend.”

Q218: How do you configure load balancing?

What it is: An Nginx upstream groups backends: least_conn picks the least busy server, weight=3 triples one server’s share, backup takes traffic only when others are unavailable, and proxy_pass forwards to the group.

Why it is used: Spreading traffic and surviving backend failure without a hardware load balancer.

# Nginx load balancer
upstream backend {
    least_conn;
    server 192.168.1.10:80 weight=3;
    server 192.168.1.11:80;
    server 192.168.1.12:80 backup;
}

server {
    location / {
        proxy_pass http://backend;
    }
}

Interview talking point: “weight=3 shifts three times the traffic to one server while backup stays idle until the others fail, and least_conn changes the algorithm from round robin to connection-aware routing.”

Q219: How do you configure proxy server?

What it is: Squid is a caching proxy listening on http_port 3128 with cache_dir storage, acl rules, optional basic authentication and refresh_pattern cache lifetimes.

Why it is used: To share outbound web traffic, cache repeated downloads and control which clients may browse.

# Install Squid
apt install squid

# Configure
# /etc/squid/squid.conf
http_port 3128
cache_dir ufs /var/spool/squid 1000 16 256

# Access control
acl localnet src 192.168.0.0/16
http_access allow localnet
http_access deny all

# Authentication
# /etc/squid/squid.conf
auth_param basic program /usr/lib/squid3/basic_ncsa_auth /etc/squid/passwords
acl authenticated proxy_auth REQUIRED
http_access allow authenticated

# Create user
htpasswd -c /etc/squid/passwords username

# Cache rules
refresh_pattern -i \.jpg$ 10080 90% 43200
refresh_pattern -i \.html$ 1440 90% 3600

# Transparent proxy
http_port 3128 transparent

Interview talking point: “Squid evaluates http_access rules top to bottom and the config ends with http_access deny all, so only traffic matching an earlier allow rule, like localnet, passes through.”

Q220: How do you configure reverse proxy?

What it is: An Nginx reverse proxy listens on 80 for api.example.com and forwards to http://localhost:3000, passing Host, X-Real-IP, and WebSocket Upgrade headers through to the backend.

Why it is used: Exposing one public endpoint in front of application servers.

# Nginx reverse proxy
server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_cache_bypass $http_upgrade;
    }
}

Interview talking point: “proxy_set_header Host $host preserves the original hostname for the backend, and the Upgrade and Connection headers are what allow WebSocket traffic to pass through the proxy unchanged.”

Q221: How do you configure reverse proxy?

What it is: Nginx as a reverse proxy: proxy_pass forwards a location to a backend, proxy_set_header passes host and client IP headers, a second location adds basic auth, and proxy_cache_path with proxy_cache caches backend responses.

Why it is used: To front several backends with one public endpoint and cache responses.

# Nginx reverse proxy
server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://backend:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /admin {
        proxy_pass http://admin-backend:8081;
        auth_basic "Admin Area";
        auth_basic_user_file /etc/nginx/.htpasswd;
    }
}

# Cache with nginx
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=api_cache:10m max_size=1g inactive=60m;
location / {
    proxy_cache api_cache;
    proxy_cache_valid 200 60m;
    proxy_pass http://backend:8080;
}

Interview talking point: “Headers like X-Forwarded-For are required so the backend sees the real client address instead of the proxy, otherwise logs and rate limits key on the wrong IP.”

Q222: How do you implement API gateway?

What it is: An API gateway handles path-based routing, JWT authentication, rate limiting quotas, response caching, and usage monitoring.

Why it is used: To provide one entry point that owns cross-cutting API concerns.

# API gateway
# 1. Routing
# Path-based

# 2. Authentication
# JWT

# 3. Rate limiting
# Quotas

# 4. Caching
# Response

# 5. Monitoring
# Usage

Interview talking point: “Placing auth, quotas, and caching at the gateway keeps those concerns out of every individual service, so clients see one consistent front door.”

Q223: How do you implement API gateway?

What it is: An API gateway is a front-end that handles path-based routing, JWT authentication, rate limiting/quotas, response caching, and usage monitoring.

Why it is used: To centralize cross-cutting concerns and protect backend services.

# Routing
# Path-based

# Authentication
# JWT

# Rate limiting
# Quotas

# Caching
# Response

# Monitoring
# Usage

Interview talking point: “Authentication and rate limits enforce security and quotas, while caching and usage monitoring balance performance with controlled access.”

Q224: How do you implement load balancing?

What it is: HAProxy spreads traffic across backend servers with balance roundrobin, health checking each via check, tuned with settings like inter 3s fall 2 rise 1.

Why it is used: To spread load and take failed servers out of rotation automatically.

# HAProxy configuration
backend servers
    balance roundrobin
    server s1 192.168.1.10:80 check
    server s2 192.168.1.11:80 check

# Health checks
# Check inter 3s fall 2 rise 1

Interview talking point: “fall 2 rise 1 means two failed probes remove a server but one success returns it, an asymmetric setting that avoids flapping back into a still recovering host.”

Q225: How do you use Haproxy with keepalived?

What it is: HAProxy load balances HTTP traffic across checked backend servers, and keepalived watches the HAProxy process. The vrrp_script runs a process check every 2 seconds with a weight of 2 to influence VRRP priority.

Why it is used: To run a load balancer whose virtual IP fails over if the local HAProxy dies.

# haproxy.cfg
global
    log /dev/log local0
    maxconn 4000

frontend http
    bind *:80
    default_backend servers

backend servers
    balance roundrobin
    server s1 192.168.1.10:80 check
    server s2 192.168.1.11:80 check

# keepalived
vrrp_script haproxy {
    script "killall -0 haproxy"
    interval 2
    weight 2
}

Interview talking point: “killall -0 sends no signal and only tests whether the process exists, so the script flips priority based on HAProxy being alive, and the VIP moves when it is not.”

TLS and SSL

Q226: How do you configure DNS over TLS?

What it is: DNS over TLS wraps resolver queries in TLS; stubby runs a local stub resolver on 127.0.0.1 that forwards to authenticated upstreams, or systemd-resolved can do it directly.

Why it is used: To stop network observers from seeing or tampering with the domains a host resolves.

# Install stubby
apt install stubby

# Configure
# /etc/stubby/stubby.yml
resolution_type: GETDNS_RESOLUTION_TYPE_STUB
listen_addresses:
  - 127.0.0.1@53
upstream_recursive_servers:
  - address_data: 1.1.1.1
    tls_auth_name: "cloudflare-dns.com"
  - address_data: 8.8.8.8
    tls_auth_name: "dns.google"

# Enable systemd-resolved
systemctl start stubby
systemctl enable stubby

# Configure systemd-resolved
# /etc/systemd/resolved.conf
[Resolve]
DNS=127.0.0.1
DNSOverTLS=yes

# Test
dig @127.0.0.1 example.com +tls

Interview talking point: “tls_auth_name in stubby.yml pins the expected certificate name for each upstream, and dig against 127.0.0.1 with +tls verifies resolution actually goes out encrypted.”

Q227: How do you configure SSL/TLS?

What it is: openssl req generates a key and CSR, openssl x509 signs the CSR into a certificate, and the Nginx block on 443 references both files while allowing only TLS 1.2 and 1.3.

Why it is used: Serving encrypted HTTPS traffic with a trusted or self-signed certificate.

# Generate CSR
openssl req -new -newkey rsa:4096 -nodes -keyout server.key -out server.csr

# Generate self-signed
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

# Nginx config
server {
    listen 443 ssl http2;
    ssl_certificate /etc/ssl/certs/server.crt;
    ssl_certificate_key /etc/ssl/private/server.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
}

Interview talking point: “-nodes leaves the private key unencrypted so services can start unattended, and once certificate and key paths are set, ssl_protocols restricted to TLSv1.2 and TLSv1.3 is what disables older versions.”

Q228: How do you implement mTLS?

What it is: Mutual TLS encrypts and authenticates service-to-service traffic. Istio enables it with a PeerAuthentication resource set to mode STRICT, while Linkerd enables it automatically.

Why it is used: To ensure only authenticated, encrypted connections run between services in the mesh.

# Istio mTLS
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT

# Or use Linkerd
# Linkerd automatically mTLS
linkerd jaeger | kubectl apply -f -

Interview talking point: “Istio requires an explicit PeerAuthentication resource with mode STRICT, whereas Linkerd turns mTLS on by itself, so the mesh choice changes how much config secures service traffic.”

Q229: How do you implement TLS everywhere?

What it is: TLS deployment: an nginx server block listening on 443 with certificate paths, TLS 1.2 and 1.3 only, and a restricted cipher list, plus database ssl settings for PostgreSQL and MySQL.

Why it is used: Encrypts traffic in transit for both web frontends and databases.

# Nginx
server {
    listen 443 ssl http2;
    ssl_certificate /etc/ssl/certs/server.crt;
    ssl_certificate_key /etc/ssl/private/server.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
}

# Database
# PostgreSQL: ssl = on
# MySQL: require ssl

Interview talking point: “Databases do not inherit the web server’s TLS settings, so ssl = on or require ssl must be configured per database engine to cover backend connections.”

Q230: How do you use OpenSSL?

What it is: OpenSSL handles TLS and X.509. It generates RSA keys, creates a CSR, produces a self-signed certificate, prints certificate details, verifies against a CA, and converts between PEM and DER.

Why it is used: To create, inspect, verify, or convert certificates and keys when deploying services that use TLS.

# Generate private key
openssl genrsa -out private.key 2048

# Generate CSR
openssl req -new -key private.key -out request.csr

# Self-signed certificate
openssl req -x509 -days 365 -key private.key -in request.csr -out certificate.crt

# View certificate
openssl x509 -in certificate.crt -text -noout

# Verify
openssl verify -CAfile ca.crt certificate.crt

# Convert formats
openssl x509 -in cert.pem -outform DER -out cert.der

Interview talking point: “openssl x509 -text -noout dumps readable certificate fields without writing anything back, while verify -CAfile shows whether a certificate chains to your CA. The same x509 tool performs format conversion using -outform DER.”

DNS Services

Q231: How do you configure BIND DNS?

What it is: BIND serves DNS from /etc/named.conf, which declares master zones; forward.zone holds the SOA with serial and timers plus NS and A records, and reverse.zone maps addresses back to names.

Why it is used: Running authoritative DNS for your own domains and reverse space.

zone "example.com" {
    type master;
    file "forward.zone";
};

zone "1.168.192.in-addr.arpa" {
    type master;
    file "reverse.zone";
};

# forward.zone
$TTL 86400
@  IN  SOA ns1.example.com. admin.example.com. (
        2023010101 ; Serial
        3600       ; Refresh
        1800       ; Retry
        604800     ; Expire
        86400 )    ; Minimum TTL
@       IN  NS      ns1.example.com.
ns1     IN  A       192.168.1.10
www     IN  A       192.168.1.20

Interview talking point: “The SOA serial must be incremented on every zone edit, otherwise secondary servers never detect the change, while Refresh, Retry, and Expire control how often they check back.”

Q232: How do you configure BIND DNS?

What it is: BIND is the authoritative DNS server. The config declares a forward master zone and a reverse in-addr.arpa zone, and the zone file holds the TTL, SOA, name server, and A records mapping names to addresses.

Why it is used: To resolve names to addresses for a domain you operate, with answers that are authoritative.

zone "example.com" {
    type master;
    file "forward.zone";
};

zone "1.168.192.in-addr.arpa" {
    type master;
    file "reverse.zone";
};

# forward.zone
$TTL 86400
@ IN SOA ns1.example.com. admin.example.com. (
    2023010101 3600 1800 604800 86400)
@ IN NS ns1.example.com.
ns1 IN A 192.168.1.10
www IN A 192.168.1.20

Interview talking point: “The reverse zone is written in in-addr.arpa form for the 192.168.1 network, so forward name lookups and reverse address lookups come from two separate zone files you maintain.”

Q233: How do you configure BIND9?

What it is: BIND9 is a DNS server. Its options file sets cache directory, forwarders, and listen address, while a zone file holds the SOA record, serial, NS, and A entries for a domain.

Why it is used: To run an authoritative DNS zone and validate changes before serving them.

# Install
apt install bind9

options {
    directory "/var/cache/bind";
    forwarders {
        8.8.8.8;
        8.8.4.4;
    };
    dnssec-validation auto;
    listen-on { any; };
};

# Zone file
# /etc/bind/db.example.com
$TTL    604800
@       IN      SOA     ns1.example.com. admin.example.com. (
                     2024010101         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      ns1.example.com.
@       IN      A       192.168.1.10
ns1     IN      A       192.168.1.10
www     IN      A       192.168.1.10

# Test configuration
named-checkconf
named-checkzone example.com /etc/bind/db.example.com

Interview talking point: “The serial in the SOA must increment for secondary servers to pick up zone changes, and running named-checkzone first catches syntax errors without touching production.”

Q234: How do you configure DNS server?

What it is: A BIND9 DNS server defines forwarders and DNSSEC validation in named.conf.options, a master zone in named.conf.local, and records in a zone file.

Why it is used: To resolve names authoritatively for a domain and forward everything else upstream.

# Install BIND9
apt install bind9 bind9utils

# Configure named.conf.options
# /etc/bind/named.conf.options
options {
    directory "/var/cache/bind";
    forwarders {
        8.8.8.8;
        8.8.4.4;
    };
    dnssec-validation auto;
    listen-on { any; };
};

# Create zone
# /etc/bind/named.conf.local
zone "example.com" {
    type master;
    file "/etc/bind/db.example.com";
};

# Create zone file
# /etc/bind/db.example.com
$TTL    604800
@       IN      SOA     ns1.example.com. admin.example.com. (
                     2024010101         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      ns1.example.com.
ns1     IN      A       192.168.1.10
www     IN      A       192.168.1.10

Interview talking point: “The SOA serial must be incremented when the zone file changes, otherwise secondary servers never pick up the new records, and the A record maps names like www to 192.168.1.10.”

Q235: How do you configure Dnsmasq?

What it is: Dnsmasq is a small daemon combining DNS and DHCP for a local network. It can serve static name records, forward unknown queries upstream, define a DHCP range, and reserve addresses by MAC.

Why it is used: To give a small network DNS and DHCP in one lightweight service instead of two.

# Install
apt install dnsmasq

interface=eth0
bind-interfaces
domain=example.com
local=/example.com/

# DNS
address=/example.com/192.168.1.10
address=/www.example.com/192.168.1.10

# DHCP
dhcp-range=192.168.1.100,192.168.1.200,12h
dhcp-option=option:router,192.168.1.1
dhcp-option=option:dns-server,192.168.1.1

# Static DHCP
dhcp-host=00:11:22:33:44:55,192.168.1.50

# DNS forwarding
server=8.8.8.8
server=8.8.4.4

Interview talking point: “address lines create local A records while server lines forward everything else, so dnsmasq can be the only DNS server a LAN needs, and dhcp-host reserves an address by MAC.”

Q236: How do you configure dynamic DNS?

What it is: Dynamic DNS updates records automatically; a client daemon holds credentials and pushes changes to the update server, while nsupdate sends interactive updates such as adding an A record with a TTL.

Why it is used: Keeping DNS current for hosts whose addresses change.

# Client side (dhclient)
protocol=dhcp
use=if, if=eth0
server=dynupdate.example.com
login=username
password=secret
mydomain.example.com

# Server side (nsupdate)
nsupdate
server ns1.example.com
update add host.example.com 3600 A 192.168.1.50
send

Interview talking point: “nsupdate takes a server line, then update add with a record and TTL, then send, so records change without editing zone files, which is exactly what DHCP-driven environments need.”

Q237: How do you configure split DNS?

What it is: Split DNS serves different answers depending on the requester using BIND views. One view matches internal clients and serves an internal zone file, another matches everyone else and serves an external file with different A records.

Why it is used: To give internal hosts private addresses while external users get public ones from the same server.

# BIND configuration for split DNS
# Internal view
view "internal" {
    match-clients { 192.168.0.0/16; };

    zone "example.com" {
        type master;
        file "db.internal.example.com";
    };
};

# External view
view "external" {
    match-clients { any; };

    zone "example.com" {
        type master;
        file "db.external.example.com";
    };
};

# Using different A records
# Internal: 192.168.1.10
# External: 203.0.113.10

# Test from internal
dig @internal-dns.example.com www.example.com +short

# Test from external
dig @external-dns.example.com www.example.com +short

Interview talking point: “Views are selected by match-clients, so the internal range must be listed before the catch-all external view, and testing with dig against each server name confirms the right answer per side.”

Q238: How do you configure winbind?

What it is: Winbind uses Samba to talk to Active Directory, installed with libpam-winbind, configured in smb.conf with workgroup, security = ads, realm, and enumeration flags, then joined with net ads join.

Why it is used: Resolve AD users and groups on Linux and let them authenticate through PAM.

# Install
apt install winbind libpam-winbind

[global]
   workgroup = EXAMPLE
   security = ads
   realm = EXAMPLE.COM
   winbind enum users = yes
   winbind enum groups = yes

# Join domain
net ads join -U admin

# Enable
systemctl enable winbind

Interview talking point: “security = ads plus the realm line is what puts Samba into AD mode, and winbind enum users = yes controls whether full user lists can be enumerated, which some environments turn off for performance.”

Q239: How do you manage DNS zones?

What it is: Zone management validates zone files with named-checkzone and the whole config with named-checkconf -z, applies changes with rndc reload, then verifies with dig or nslookup against the local server.

Why it is used: Updating DNS records without disrupting or restarting the resolver.

# Add record
named-checkzone example.com forward.zone

# Reload
rndc reload

# Add zone
named-checkconf -z /etc/named.conf

# Test resolution
dig @localhost example.com
nslookup example.com localhost

Interview talking point: “named-checkzone catches a syntax error before anything reaches the running daemon, and rndc reload applies a good edit without a full restart, so a bad zone never takes DNS offline.”

Q240: How do you configure DNS security?

What it is: DNSSEC signs zones with keys from dnssec-keygen and signatures from dnssec-signzone so resolvers can validate answers. BIND and Unbound both enable validation in their config.

Why it is used: To stop spoofed or forged DNS answers from being trusted by clients.

# DNSSEC with BIND
# Enable in named.conf
dnssec-validation auto;
dnssec-lookaside auto;

# Sign zone
dnssec-keygen -a RSASHA256 -b 2048 -n ZONE example.com
dnssec-signzone -S -o example.com db.example.com

# Configure resolver
# /etc/bind/named.conf.options
options {
    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;
};

# Test DNSSEC
dig +dnssec example.com
dig +cd secure.example.com

# Unbound configuration
# /etc/unbound/unbound.conf
server:
    val-log-level: 2
    harden-glue: yes
    harden-dnssec: yes
    use-caps-for-id: yes

# Query validation
drill -S example.com

Interview talking point: “dig +dnssec requests records with their signatures, while the cd flag disables checking so you can compare validated and unvalidated answers during troubleshooting.”

DHCP Server

Q241: How do you configure DHCP server?

What it is: dhcpd.conf defines a subnet with an address range, router, subnet mask, DNS servers, and default and maximum lease times that clients receive automatically.

Why it is used: Automating IP addressing and network options for hosts on a LAN.

subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.100 192.168.1.200;
    option routers 192.168.1.1;
    option subnet-mask 255.255.255.0;
    option domain-name-servers 8.8.8.8, 8.8.4.4;
    default-lease-time 600;
    max-lease-time 7200;
}

Interview talking point: “default-lease-time 600 and max-lease-time 7200 bound the lease a client receives; shorter leases recycle addresses faster but cause more renewals, while longer leases reduce traffic and slow reclamation.”

Q242: How do you configure DHCP server?

What it is: A DHCP server configuration for the 192.168.1.0 network. It defines a pool of addresses from .100 to .200 and hands out the router, subnet mask, and DNS servers with default and maximum lease times.

Why it is used: To assign IP addresses and network settings automatically to hosts joining the network.

subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.100 192.168.1.200;
    option routers 192.168.1.1;
    option subnet-mask 255.255.255.0;
    option domain-name-servers 8.8.8.8, 8.8.4.4;
    default-lease-time 600;
    max-lease-time 7200;
}

Interview talking point: “default-lease-time and max-lease-time bound how long an address is lent: a 600 second default recycles addresses quickly, while the maximum caps what a client may request.”

Q243: How do you configure DHCP server?

What it is: A DHCP server hands out addresses from a defined range per subnet, along with router, mask, DNS, and domain options. A host block maps a fixed address to a MAC address, and grants land in the leases file.

Why it is used: To automatically assign IP configuration to clients and reserve stable addresses for known machines.

# Install
apt install isc-dhcp-server

default-lease-time 600;
max-lease-time 7200;

subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.100 192.168.1.200;
    option routers 192.168.1.1;
    option subnet-mask 255.255.255.0;
    option domain-name-servers 8.8.8.8, 8.8.4.4;
    option domain-name "example.com";
}

host static-client {
    hardware ethernet 00:11:22:33:44:55;
    fixed-address 192.168.1.50;
}

# Restart
systemctl restart isc-dhcp-server

# View leases
cat /var/lib/dhcp/dhcpd.leases

Interview talking point: “A static reservation ties a fixed address to a hardware ethernet MAC inside the pool, giving consistency without configuring the client by hand, and dhcpd.leases is where you confirm what was actually granted.”

Q244: How do you configure DHCP server?

What it is: A DHCP server from isc-dhcp-server hands out addresses from a subnet range in dhcpd.conf along with router, mask and DNS options.

Why it is used: To assign IP configuration automatically to every host on a LAN.

# Install DHCP server
apt install isc-dhcp-server

# Configure
# /etc/dhcp/dhcpd.conf
default-lease-time 600;
max-lease-time 7200;

subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.100 192.168.1.200;
    option routers 192.168.1.1;
    option subnet-mask 255.255.255.0;
    option domain-name-servers 8.8.8.8, 8.8.4.4;
    option domain-name "example.com";
}

# Static IP reservation
host printer {
    hardware ethernet 00:11:22:33:44:55;
    fixed-address 192.168.1.50;
}

# Start service
systemctl start isc-dhcp-server
systemctl enable isc-dhcp-server

Interview talking point: “The host block binds a MAC address to a fixed-address, so the printer always receives 192.168.1.50 yet still gets its lease from DHCP rather than being configured on the device.”

Firewall Fundamentals

Q245: What is iptables and how do you configure basic rules?

What it is: iptables filters packets through chains such as INPUT and can NAT traffic through the nat table, with rules appended and matched in order until a target is reached.

Why it is used: To allow only needed ports, redirect inbound traffic, and masquerade outbound connections.

# List rules
iptables -L -n -v
iptables -t nat -L -n -v

# Basic rules
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j DROP

# NAT rules
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

# Save rules
iptables-save > /etc/iptables/rules.v4
# or
service iptables save

Interview talking point: “Rules are evaluated in the order added, so a final INPUT DROP swallows everything not matched earlier, meaning the port 22 and 80 rules must come first. -L -n -v shows hit counters per rule.”

Q246: How do you configure a firewall with firewalld?

What it is: firewalld manages firewall rules by zones and services, applying changes with firewall-cmd and storing permanent rules that take effect after a reload.

Why it is used: To open HTTP, HTTPS, or custom ports without editing raw rule syntax each time.

# Check status
firewall-cmd --state
firewall-cmd --list-all

# Add services
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https

# Add ports
firewall-cmd --permanent --add-port=8080/tcp

# Zones
firewall-cmd --permanent --zone=public --add-service=ssh
firewall-cmd --set-default-zone=trusted

# Reload
firewall-cmd --reload

Interview talking point: “A rule added without —permanent applies only until the next reload, while —permanent waits for firewall-cmd —reload. Zones decide which rules apply to which interface, so the default zone matters as much as the service choice.”

Q247: How do you configure firewall (iptables)?

What it is: An iptables firewall sets default chain policies, then allows loopback, established connections via conntrack, and specific ports such as 22, 80, and 443 before saving with iptables-save.

Why it is used: To restrict inbound traffic to known services and block everything else by default.

# Default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT

# Allow established
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow services
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Save
iptables-save > /etc/iptables/rules.v4

Interview talking point: “The ESTABLISHED,RELATED rule lets reply packets of existing connections back in so no matching outbound rule is needed, and DROP as a policy silently discards unmatched traffic rather than rejecting it.”

Q248: How do you configure firewall rules?

What it is: iptables builds packet filter rules across tables, with default policies and appended rules for loopback, established connections, and allowed ports such as SSH and HTTP.

Why it is used: To control which inbound and forwarded traffic a host accepts, and to persist those rules across reboots.

# Basic iptables rules
# Flush existing rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t mangle -F

# Default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow SSH
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set
iptables -A INPUT -p tcp --dport -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

# Allow HTTP/HTTPS
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Save rules
iptables-save > /etc/iptables/rules.v4

Interview talking point: “Setting the INPUT policy to DROP means any port not explicitly allowed is blocked, and the ESTABLISHED,RELATED rule lets replies back in so only new connections are evaluated.”

Q249: How do you configure firewall?

What it is: iptables lists and appends packet rules and saves them with iptables-save, firewalld uses firewall-cmd for services and ports, and ufw is a simpler allow-and-enable frontend.

Why it is used: To restrict inbound traffic so only required services are reachable.

# iptables
iptables -L -n
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP
iptables-save > /etc/iptables/rules.v4

# firewalld
firewall-cmd --list-all
firewall-cmd --add-service=ssh
firewall-cmd --add-port=8080/tcp
firewall-cmd --reload

# ufw
ufw status
ufw allow ssh
ufw enable

Interview talking point: “firewall-cmd edits need —reload to take effect, and ufw allow ssh is the friendly equivalent of appending an iptables ACCEPT rule, while iptables rules only survive a reboot if saved.”

Q250: How do you configure IP masquerading?

What it is: IP masquerading rewrites outbound source addresses in the nat table, with IP forwarding enabled by sysctl and DNAT used for inbound port redirection.

Why it is used: To let a private network reach the internet or expose an internal service through one gateway address.

# Enable IP forwarding
sysctl -w net.ipv4.ip_forward=1

# Add to /etc/sysctl.conf
net.ipv4.ip_forward=1

# NAT with iptables
# Outbound NAT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Or specific IP
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 203.0.113.10

# Inbound port forwarding
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:8080

# Save rules
iptables-save > /etc/iptables/rules.v4
# or
service iptables save

Interview talking point: “SNAT with a fixed to-source suits a stable public IP while MASQUERADE adapts automatically, which matters on links where the address can change.”