OS Services MCQ 60 Practice Tests With Answers (2026)

Incorrect·A: The parameters are stored in a block or table in main memory, and the physical address of that block is passed as a pointer in a single register

Three parameter-passing strategies exist: (1) registers (fastest, limited by register count), (2) block/table in memory with address in one register (used by Linux on x86 for >6 args), and (3) the stack. The block method is the most scalable: all parameters are written to a user-space memory block, and a single register holds the block's address — the kernel reads the parameters from there.

Incorrect·C: Creating a new child process (e.g., fork()) or replacing the core memory space with a new program (e.g., exec())

Process Control system calls manage process lifecycle: fork() clones the current process, exec() replaces the calling process's memory image with a new program, wait() suspends the parent until a child exits, exit() terminates a process, and kill() sends a signal. These are the fundamental building blocks of every Unix process creation and shell pipeline mechanism.

Incorrect·B: File Manipulation

open(), read(), write(), close(), seek(), and stat() are File Manipulation system calls. They operate on file descriptors — abstract handles the kernel returns upon successful open(). While file descriptors can also refer to pipes, sockets, and devices (Unix "everything is a file" philosophy), when used on regular files these are categorically File Manipulation calls.

Incorrect·D: To perform highly specific, device-dependent hardware operations that cannot be handled by standard read/write functions

ioctl() is the "escape hatch" of the device API. Standard read/write semantics cannot express operations like "set baud rate on a serial port," "eject a CD-ROM tray," or "query a network interface's MTU." ioctl() accepts a device-specific command code and optional argument, passing it directly to the device driver which interprets it according to the hardware's capabilities.

Incorrect·A: Changing the file permission bits (e.g., chmod()) to dictate which users can execute a specific script

Protection system calls control access rights to resources: chmod() modifies Unix permission bits (rwx for owner/group/others), chown() changes file ownership, setuid()/setgid() alter process privilege, and umask() sets default permission masks. These calls directly implement the OS's discretionary access control (DAC) model, governing which subjects can perform which operations on which objects.

Incorrect·C: The SCI intercepts the function call from the API, looks up the corresponding system call number, and triggers the necessary software trap

When an application calls, e.g., write(), the libc wrapper (SCI layer) loads the system call number (e.g., NR_write = 1 on Linux x86-64) into the designated register (rax), places arguments in other registers, then executes the syscall instruction. This triggers a software trap, switching the CPU to Ring 0. The kernel's system call dispatcher reads the number and routes to the correct kernel function.

Incorrect·B: The Win32 API

The Win32 API (now part of the broader Windows API) is the definitive interface for Windows application development. Functions like CreateProcess(), ReadFile(), CreateMutex(), and VirtualAlloc() are Win32 calls that ultimately invoke Windows NT kernel services via the Windows Native API (ntdll.dll → NT system calls). All Windows GUI and system applications are built atop Win32.

Incorrect·D: The Java API is executed by the JVM, which translates standardized requests into the specific, host-native APIs of the underlying OS

Java achieves platform independence through the JVM abstraction layer. A Java application calls java.io.FileOutputStream.write() — one consistent API regardless of OS. The JVM (e.g., HotSpot) translates this into the correct host OS call: write() on Linux, WriteFile() on Windows. The JVM itself is a native binary compiled for each platform, bridging Java's portable bytecode world to OS-specific system calls.

Incorrect·A: To intercept, record, and display all the system calls invoked by a running process, allowing developers to debug API interactions

strace uses the ptrace() system call to attach to a target process and intercept each system call entry and exit, printing the call name, parameters, return value, and errno. This is invaluable for debugging applications that fail silently — revealing exactly which file they tried to open, which permissions they lacked, or which network connection they attempted. dtruss on macOS uses DTrace for the same purpose.

Incorrect·C: Utilizing Parity bits and Error-Correcting Code (ECC) directly within the RAM modules to detect and correct single-bit flips

ECC RAM adds extra bits (typically using Hamming codes) to each memory word. On every read, the ECC circuit recalculates the check bits and compares them — single-bit errors are silently corrected, and double-bit errors are detected and reported to the OS. The OS can then log the correctable error event, alert administrators, or trigger kernel panic for uncorrectable errors. This is mandatory in servers and mission-critical systems.

Incorrect·B: The OS traps the fault, forcefully terminates the offending process, reclaims its allocated memory, and generates an error log or core dump

A segmentation fault triggers a hardware protection fault (SIGSEGV on Linux). The MMU detects the illegal access, generates a page-fault or protection exception, and the CPU vectors to the OS fault handler. The OS sends SIGSEGV to the offending process, which terminates it, reclaims all its memory and file descriptors, optionally writes a core dump for post-mortem analysis, and logs the event.

Incorrect·D: It provides the essential wrapper functions that load parameters into CPU registers and trigger the software interrupt required for the system call

libc (glibc on Linux) is the bridge between C application code and kernel system calls. When you call printf(), fopen(), or malloc(), libc functions handle buffering and then invoke the underlying system call (write(), open(), brk()/mmap()) by marshaling arguments into the correct registers and executing the syscall instruction. Without libc, developers would need to write raw assembly for every kernel interaction.

Incorrect·A: Proxy code generated on both client and server sides that handles the complex marshaling and unmarshaling of parameters for network functions

RPC stubs eliminate the complexity of distributed communication. A client stub looks like a local function but actually serializes (marshals) parameters into a network message and sends it to the remote server. The server stub receives the message, deserializes (unmarshals) parameters, calls the actual function, then marshals the return value back. IDL compilers (like gRPC protoc) generate stubs automatically.

Incorrect·C: To generate statistical reports used for performance tuning, capacity planning, and establishing resource quotas

Enterprise OS accounting data (CPU time per process, memory high-water marks, I/O operation counts) feeds capacity planning tools, SLA monitoring dashboards, and chargeback systems. Administrators use it to identify resource hogs, set per-user quotas (ulimits, cgroups), predict when infrastructure upgrades are needed, and prove SLA compliance to customers.

Incorrect·B: A set of explicit access rights defining precisely which operations a specific process or user is legally permitted to execute on specific objects

A Protection Domain (introduced by Lampson) is a set of (object, rights) pairs — for example, {file_A: read+write, file_B: read, printer: print}. Every process executes within a domain. The OS enforces the Access Matrix by checking the domain's rights before allowing any operation. Processes can switch domains (e.g., via setuid) subject to policy constraints.

Incorrect·D: The developer must explicitly implement synchronization primitives (like mutexes) to prevent race conditions when multiple processes write simultaneously

Shared memory provides no built-in synchronization. If process A and process B both write to the shared region simultaneously without coordination, the result is a race condition — corrupted data with non-deterministic behavior. Developers must layer explicit synchronization: POSIX semaphores, mutexes (via pthread_mutexattr_setpshared), or spinlocks over the shared region to serialize access.

Incorrect·A: The application passes a specific integer in a designated CPU register, which the kernel uses as an index into the system call vector table

On Linux x86-64, the system call number is loaded into the rax register before the syscall instruction. The kernel's system call dispatcher (in entry.S) uses this number as an index into sys_call_table[] — an array of function pointers to kernel implementations. On Linux, read=0, write=1, open=2, etc. This O(1) dispatch is both fast and secure.

Incorrect·C: A Device Manipulation call

Device Manipulation (Device Management) system calls configure, control, and query physical devices: ioctl() for device-specific commands, read()/write() on device files, request_device()/release_device() equivalents. Setting serial port baud rate (tcsetattr() which wraps ioctl(TCSETS)), configuring monitor resolution (via DRM ioctl), or ejecting media are all Device Manipulation operations.

Incorrect·B: A tiny piece of code stored in ROM that initializes system components and loads the OS kernel into RAM to begin execution

The Bootstrap Program (bootstrap loader) is a minimal program stored in ROM/flash (BIOS/UEFI). On power-on, the CPU executes it from a fixed address. It runs POST (Power-On Self-Test), initializes RAM and essential hardware, locates the boot device, loads the boot loader (GRUB/systemd-boot) into RAM, and transfers control. The boot loader then finds and loads the OS kernel image.

Incorrect·D: Because a pipe creates a unidirectional data channel specifically for streaming data output from one active process directly into the input of another

pipe() creates a unidirectional FIFO byte stream between processes — a kernel-managed in-memory buffer. Though pipes use file descriptors, their purpose is inter-process data flow (the shell's ls | grep pattern), not file storage. The OS is mediating communication between two running processes, which is definitionally an IPC/Communications service rather than persistent file manipulation.

Incorrect·C: The CPU state (registers, program counter) is meticulously saved to the process's dedicated kernel stack, ensuring the exact state can be restored

On syscall entry, the CPU hardware automatically saves the user-mode instruction pointer (RIP), stack pointer (RSP), CPU flags, and segment registers onto the process's kernel stack. The kernel then saves general-purpose registers (pt_regs struct on Linux). On syscall return, these are restored, and execution resumes in user mode at exactly the instruction following the syscall — as if nothing happened.

Incorrect·A: It moves traditional kernel services into user-space as isolated server processes; applications use message passing (IPC) to request services

A microkernel (L4, seL4, QNX) keeps only IPC, basic scheduling, and memory mapping in the kernel. File servers, device drivers, and network stacks run as ordinary user-space processes. An application sends an IPC message to the file server process to perform file operations. A bug in the file server crashes only that server — not the kernel — dramatically improving fault isolation, though at the cost of IPC overhead on every service call.

Incorrect·B: It allows a parent process to observe and intimately control the execution of another process, inspecting its memory and intercepting its system calls

ptrace() is the foundation of all Unix debuggers and strace. A tracer process can attach to any process it owns (or any process if root), causing the tracee to stop on every system call entry/exit. The tracer can then inspect and modify the tracee's registers, memory, and signal delivery. GDB uses ptrace() for breakpoints and single-stepping; seccomp-bpf uses it for syscall sandboxing in Chrome and Docker.

Incorrect·D: A trap is generated synchronously by the currently executing instruction, whereas an interrupt is generated asynchronously by external hardware devices

A trap (software exception) is synchronous: it is caused by the currently executing instruction — a divide-by-zero, illegal opcode, page fault, or deliberate int/syscall instruction for system calls. A hardware interrupt is asynchronous: it arrives from external hardware (timer, NIC, keyboard) at any point in the instruction stream. Both transfer control to the OS, but traps are precisely tied to a specific instruction while interrupts are not.

Incorrect·A: It maps the contents of a file directly into the virtual address space of a process, allowing read/write operations using standard memory pointers

mmap() creates a mapping between a file (or anonymous memory) and a region of the process's virtual address space. File-backed mmap() means the kernel page cache backs the mapping — reads cause page faults that load file data into RAM, writes modify the page cache (and eventually the file). This enables zero-copy file I/O, memory-mapped databases (SQLite, LMDB), and the exec() loader which mmap()s ELF segments directly.

Incorrect·C: Sockets act as communication endpoints characterized by an IP address concatenated with a port number, allowing discrete message passing over networks

A socket (Berkeley Sockets API) is an OS abstraction for a bidirectional network communication endpoint. It is identified by a (protocol, IP address, port) triple. socket() creates it, bind() assigns an address, connect()/accept() establishes the connection, and send()/recv() exchange data. The OS manages the TCP/IP stack below the socket API, handling segmentation, retransmission, and flow control transparently.

Incorrect·B: A highly optimized, high-speed message-passing IPC mechanism used extensively internally by Windows subsystems and services to communicate securely

ALPC (Advanced Local Procedure Call) is the internal IPC backbone of Windows NT, replacing the older LPC. It enables communication between kernel-mode components (like the Win32k.sys subsystem), user-mode subsystem servers (csrss.exe), and services (lsass.exe). ALPC is used by every Win32 API call that crosses subsystem boundaries. It supports both synchronous and asynchronous message passing with very low latency via a shared-memory "section object" optimization for large messages.

Incorrect·D: By creating a logical grid where rows represent domains, columns represent objects, and the intersecting cells define the exact privileges granted

The Access Matrix (Lampson, 1971) is a conceptual model: rows = protection domains (users/processes), columns = objects (files, devices, processes), cells = allowed rights (read, write, execute, append). In practice it is stored sparsely: as Access Control Lists (ACLs) per object (Unix permission bits, Windows DACL) or Capability Lists per domain. The OS consults the matrix on every access attempt.

Incorrect·A: Profiling periodically samples the system to build a statistical summary, while tracing records a highly detailed, chronological log of specific events

Profiling uses statistical sampling — the OS interrupts execution at fixed intervals (e.g., every 1 ms via the timer interrupt) and records the current program counter, building a histogram of where time is spent. Tracing records every occurrence of specific events (system calls, function entries, network packets) with timestamps, providing a complete chronological audit trail. Profiling has minimal overhead; tracing is more detailed but heavier.

Incorrect·C: Because ioctl() allows the developer to send arbitrary, device-specific command codes that fall outside the standardized semantics of read() or write()

The POSIX read()/write() model assumes a byte-stream or block-oriented device. Custom hardware (FPGAs, video capture cards, proprietary sensors) requires vendor-specific commands not expressible as simple read/write: "arm trigger," "set gain to 42 dB," "flush DMA ring buffer." ioctl() passes an arbitrary command code and an optional data pointer directly to the driver's ioctl handler, which interprets it per the device's datasheet.

Incorrect·B: They dynamically expose internal kernel data structures, process statuses, and hardware device trees as standard text files for user-space reading

procfs (/proc) exposes kernel data as a virtual file system — /proc/self/maps shows the current process's memory mappings, /proc/cpuinfo shows CPU details, /proc/PID/fd shows open file descriptors. sysfs (/sys) exposes the kernel's device and driver model. These are not files on disk; reads trigger kernel functions that generate the content dynamically. This gives userspace tools (ps, top, lsmod) read-only visibility into live kernel state.

Incorrect·D: AIO allows the calling process to initiate an I/O request and immediately continue executing other code without blocking

Synchronous I/O (read(), write()) blocks the calling thread until the kernel completes the operation — wasting CPU cycles waiting for disk or network. AIO (POSIX aio_read, Linux io_uring) lets the process submit an I/O request and continue executing. When the I/O completes, the OS notifies via a signal, callback, or completion queue. io_uring (Linux 5.1+) achieves near-zero-syscall overhead through shared ring buffers between user and kernel space.

Incorrect·A: It instructs the kernel to transfer data directly from the disk cache to the network socket buffer entirely within kernel space, eliminating user space copy overhead

Traditional file serving: read() copies disk data from kernel page cache → user buffer → write() copies user buffer → kernel socket buffer → NIC (2 copies, 4 context switches). sendfile() performs the transfer entirely in kernel space: page cache → socket buffer → NIC, with zero user-space copies and only 2 context switches. This is how Nginx and Apache serve static files at very high throughput with minimal CPU usage.

Incorrect·C: The OS captures a complete snapshot of the crashed process's working memory state and writes it to a file for post-mortem forensic debugging

When a process receives a fatal signal (SIGSEGV, SIGABRT, SIGFPE) and the core dump limit (ulimit -c) is nonzero, the kernel writes the process's entire address space, register state, open file descriptors, and thread stacks to a core file. Developers load this into GDB (gdb ./program core) to inspect the exact state at the moment of death — the call stack, variable values, and memory contents — enabling post-mortem root-cause analysis without needing to reproduce the crash.

Incorrect·B: A high-performance, low-overhead kernel-level tracing facility provided by the Windows OS that logs hardware and software events for diagnostics

ETW is a high-speed, buffered, kernel-level tracing infrastructure built into Windows NT. Providers (kernel, drivers, user apps) emit structured events to in-memory ring buffers. A controller enables providers and sessions; consumers read the buffered events. Tools like Windows Performance Recorder (WPR), perfview, and Process Monitor use ETW. Its overhead is extremely low (<1%) because providers check a bit before emitting — if no consumer is listening, emission is a near-zero cost operation.

Incorrect·D: The kernel must rigorously verify that the pointer directs to a valid address strictly within the calling process's legitimate user address space

If the kernel blindly dereferenced a user-supplied pointer, a malicious process could pass a kernel-space address, causing the kernel to read or write arbitrary kernel memory — a privilege escalation. The kernel validates every user pointer via copy_from_user() / copy_to_user() (Linux), which checks that the address falls within the process's valid user-space VMA and handles page faults atomically. An invalid pointer causes the system call to return -EFAULT.

Incorrect·A: It changes the apparent root directory for the current running process and its children, isolating or "jailing" the process from accessing external files

chroot() changes what the process perceives as "/" — creating a "chroot jail." Paths like /etc/passwd inside the jail resolve to /new_root/etc/passwd on the real filesystem; the process cannot access files outside its jail. Modern Linux namespaces (pivot_root, mount namespaces) fix chroot's escape vulnerabilities and are used by Docker containers to provide filesystem isolation without full virtualization.

Incorrect·C: They utilize specific, high-precision hardware counters (like the HPET) to provide sub-millisecond scheduling and profiling accuracy

Standard OS time services (time(), gettimeofday()) return wall-clock time with millisecond or microsecond precision. High-Resolution Timers (hrtimers on Linux, HPET, TSC) use dedicated hardware counters — the HPET offers nanosecond resolution, the CPU's TSC (Time Stamp Counter) offers per-cycle precision. Audio/video synchronization, real-time scheduling, and performance profiling require this level of accuracy, which standard timer interrupts (1–250 Hz) cannot provide.

Incorrect·B: An asynchronous notification delivered by the OS to a process indicating an event has occurred, interrupting normal flow to execute a registered handler

Signals are the OS's software interrupt mechanism for processes. The kernel delivers a signal by setting a pending-signal bit in the process's task_struct and interrupting it at the next safe point. The process can register a signal handler (sigaction()), ignore the signal, or accept the default action (terminate, core dump, stop). SIGKILL and SIGSTOP cannot be caught or ignored — they are unconditional kernel-enforced actions.

Incorrect·D: They are pieces of object code containing functions and data that can be dynamically loaded into and unloaded from the core kernel at runtime without rebooting

LKMs (insmod/modprobe on Linux) allow device drivers, file systems, and networking protocols to be added or removed from a running kernel without reboot. A module is a relocatable ELF object; the kernel's module loader resolves its symbols against the running kernel, allocates kernel memory, and calls the module's init function. This keeps the base kernel small while allowing unlimited extensibility — virtually all Linux drivers ship as LKMs.