Everything the adaptive question bank can teach and test in Operating Systems, from foundations through advanced practice. Work through it in order, or start practising and let the questions find your level.
a program is a file on disk; a process is one running instance with its own address space, and the same program can run many times at once
•
every process carries a PID and its parent's PID; a PID is recycled after the process is reaped, so a stale PID can name someone else
•
R runnable, S interruptible sleep, D uninterruptible sleep, T stopped, Z zombie
•
a task blocked in the kernel waiting on hardware cannot be killed even by SIGKILL until that I/O returns
•
a zombie has exited but nobody read its status; an orphan is still running and gets re-parented to init
•
job control signals a whole process group, and a session binds groups to one controlling terminal
B. Creating and replacing a process
•
fork returns 0 in the child and the child's PID in the parent; both continue from the same line
•
the child does not get a memory copy; pages are shared read-only and duplicated only when one side writes
•
execve keeps the PID, open descriptors and cwd but throws away the old program's text, heap and stack, so it never returns on success
•
the shell rearranges the child's descriptors after fork and before exec, which is why the new program needs no cooperation to be redirected
•
wait/waitpid collects the exit status and frees the process entry; a parent that never waits accumulates zombies
•
an exit code is 0–255 with 0 meaning success, and a process killed by signal N is reported by the shell as 128+N
C. Threads and context switching
•
threads of a process share heap, globals and the descriptor table but each gets its own stack and registers
•
Linux creates threads and processes with the same clone call; the flags decide what is shared and what is copied
•
a switch saves and restores register state, and switching between processes also changes address space, so it costs more than switching threads
•
an unhandled fault in one thread terminates every thread, because they share one address space
D. Signals
•
an asynchronous notification that interrupts the target and runs a handler or the signal's default action
•
every signal can be caught, blocked or ignored except SIGKILL and SIGSTOP, which the kernel enforces
•
SIGTERM asks the process to shut down and lets it flush state; SIGKILL removes it immediately with no cleanup
•
SIGSEGV invalid memory access, SIGPIPE write with no reader, SIGCHLD a child changed state, SIGHUP the terminal went away
•
a blocked standard signal is marked pending, and several deliveries collapse into one
•
a handler can run in the middle of any instruction, so calling malloc or printf from it risks a deadlock
E. Scheduling and the run queue
•
the kernel takes the CPU back on a timer interrupt; a running task never has to volunteer
•
the default scheduler runs whichever runnable task has accumulated the least CPU time, rather than a fixed round-robin slot
•
nice runs from −20 to 19 and scales a task's share of contended CPU; it is not a hard priority and does nothing on an idle machine
•
a task that sleeps often has low accumulated runtime, so it is picked promptly on wake and feels responsive
•
SCHED_FIFO and SCHED_RR always outrank normal tasks, so a spinning realtime thread can starve the rest of the system
•
Linux load counts runnable plus uninterruptible tasks, so a disk stall inflates it with no CPU shortage at all
F. Virtual memory, paging and reclaim
•
each process gets a private virtual address space and the MMU translates every access, which is what makes one process unable to touch another's memory
•
translations live in per-process page tables and the TLB caches recent ones; a miss costs a page-table walk
•
a page is not brought in until it is touched, so a large executable starts without reading all of it
•
a minor fault is resolved from memory already in RAM, a major fault waits on disk and is orders of magnitude slower
•
text and read-only data low, heap growing up, the mmap region, and the stack growing down from high addresses
•
reclaim pushes cold anonymous pages to swap, and when the working set exceeds RAM the machine spends its time paging instead of computing
•
cached file pages count as used but are reclaimable on demand, so a low "free" number is the normal healthy state
•
when reclaim fails the kernel kills a chosen victim scored mostly by memory footprint, not the process that happened to ask last
G. Memory mapping, allocation and limits
•
a mapping is backed either by a file or by swap, and in both cases nothing is read until the page is touched
•
MAP_SHARED writes are seen by other mappers and reach the file; MAP_PRIVATE writes are copy-on-write and stay local
•
the allocator serves small requests from an already-obtained heap and only calls the kernel when it needs more, so free rarely returns memory to the OS
•
VSZ counts reserved address space while RSS counts resident pages, so a huge VSZ is not memory consumed
•
Linux grants more virtual memory than it can back, and the shortfall surfaces only when the pages are actually written
•
stack, heap and library base addresses move on every exec, so an attacker cannot hardcode a target address
•
a 2 MB page covers far more memory per TLB entry, but transparent huge pages can stall on allocation and waste memory, which is why latency-sensitive services often disable them
•
on a multi-socket machine, memory attached to another node is measurably slower to reach, so where a thread runs changes how fast its own data is
•
per-process ceilings on open files, stack size, address space and core dumps are inherited by children and surface as EMFILE or a refused allocation rather than a crash
H. The user/kernel boundary and system calls
•
user mode cannot touch devices or another process's memory; only kernel mode can, and hardware enforces the split
•
a syscall enters the kernel at one fixed, checked entry point with a number and arguments — it is not a call to an arbitrary kernel address
•
printf is buffering in libc on top of the write syscall, so one library call is not one crossing
•
a syscall signals failure by returning −1 and setting errno; errno is meaningless after a call that succeeded
•
an interrupt arrives asynchronously from a device, a trap is raised synchronously by the instruction being executed
I. File descriptors and the open-file model
•
files, pipes, sockets, terminals and devices are all read and written through the same small descriptor API
•
0 is stdin, 1 stdout, 2 stderr; they are ordinary descriptors and can be redirected independently
•
open always returns the lowest unused descriptor, which is exactly what makes the close-then-open redirection trick work
•
a duplicated descriptor shares one file offset, while a second open of the same path gets an independent one
•
O_APPEND makes every write land atomically at the end, O_TRUNC empties an existing file, O_CREAT with O_EXCL refuses to clobber
•
descriptors survive exec unless O_CLOEXEC is set, which is how a private file handle leaks into an unrelated child program
•
unlink removes the name, but the blocks are released only when the last descriptor closes, so truncating beats deleting a live log
J. Filesystems, inodes and links
•
type, permissions, owner, timestamps, size and block pointers live in the inode; the file's name does not
•
a directory is a table of name-to-inode entries, which is why renaming within a filesystem moves no data
•
hard links share one inode and a link count, so there is no "original" and no copy
•
a symbolic link holds text resolved at each use, so it can dangle, can cross filesystems, and follows the target's permissions
•
mtime tracks content, atime tracks reads, ctime tracks inode changes such as a chmod, and creation time is not portably available
•
a filesystem with free space can still refuse new files once its inode table is full, which millions of tiny files will do
K. Paths, mounts and the directory tree
•
everything hangs off a single /; another disk appears at a mount point rather than as a separate drive letter
•
resolution starts at the root or at the process's own current directory, which each process carries and can change
•
x on a directory permits passing through it and r permits listing it, so a readable file can sit in an unlistable directory
•
mounting over a non-empty directory conceals its contents until unmount; nothing is deleted
All exam, test, and product names and trademarks are the property of their respective owners and are used here for identification and reference only. Keentune is independent study practice — not affiliated with, authorized, or endorsed by any of these organizations.