Linux Cheat Sheet 2026

The 30 highest-yield Linux facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which nftables command lists all current rules and tables? → nft list ruleset
2. What is a Docker bind mount, as opposed to a named volume? → A direct mapping of a specific host directory or file path into the container
3. Which command converts an existing linear logical volume to use RAID1 mirroring? → lvconvert --type raid1 -m1 /dev/vg0/lv1
4. Which boot parameter disables all CPU mitigations for Spectre/Meltdown vulnerabilities, sometimes used for performance testing? → mitigations=off
5. Which tool is used to audit Linux system calls made by a process for security analysis? → strace
6. Which tool scans for open ports and services on a target host? → nmap
7. A directory has permissions drwxr-x---. Which users can list its contents? → The owner and members of the directory's group
8. Which directory contains essential system files such as the kernel and bootloader files? → /boot
9. Which command shows which package owns a specific file on a Debian-based system? → dpkg -S /path/to/file
10. Which of the following commands is used to determine a system's current IP address? → Ifconfig
11. How should Linux professionals handle technical procedures that have been updated or revised? → Review the updates, complete any required training, and implement the revised procedures
12. Which file defines the default password aging policy for new user accounts on a Linux system? → /etc/login.defs
13. Which command would you use to display a detailed, multi-line report of the attributes for a specific Physical Volume, such as `/dev/sda2`? → `pvdisplay /dev/sda2`
14. Which docker run flag makes a container automatically restart unless it is explicitly stopped by the administrator? → --restart=unless-stopped
15. A Linux machine does not have Internet connectivity. Which command displays information about the system's network gateway? → Route
16. Which command makes iptables rules persistent across reboots on Debian/Ubuntu systems? → iptables-save > /etc/iptables/rules.v4
17. An admin wants to capture all failed SSH login attempts from the journal. Which journalctl command filters only for sshd unit logs? → journalctl -u sshd
18. Which command recursively changes permissions for all files and directories under /var/www to 755? → chmod -R 755 /var/www
19. You want to find all files modified in the last 24 hours under `/var/log`. Which command is correct? → find /var/log -mtime -1
20. What is the most effective approach to system administration in the Linux field? → Systematic planning and continuous improvement
21. Which `/proc` entry provides the current working directory of a running process with PID 1234? → /proc/1234/cwd
22. Which command checks whether auditd is actively capturing events and shows its current running status? → auditctl -s
23. What is the primary consideration when implementing changes to networking? → Impact assessment and change management
24. Which file contains the mapping between major device numbers and kernel modules/drivers on a Linux system? → /proc/devices
25. Which firewalld zone is most restrictive and drops all incoming connections without any notification? → drop
26. In the context of YUM/DNF, what is a 'group' install? → Installing a predefined collection of related packages
27. How do you rate-limit SSH connections using iptables to prevent brute-force attacks? → iptables -A INPUT -p tcp --dport 22 -m recent --rcheck --seconds 60 --hitcount 4 -j DROP
28. What is the most effective approach to package management in the Linux field? → Systematic planning and continuous improvement
29. What is the minimum number of days between password changes controlled by in /etc/shadow? → Field 4 — minimum password age
30. Which lvcreate option specifies the number of stripes when creating a striped logical volume? → -i