117-201 · Question #336
Which one of these directories should not be backed up?
The correct answer is D. /proc. See the full explanation below for the reasoning.
Question
Options
- A/backup
- B/etc
- C/opt
- D/proc
- E/var/log
How the community answered
(48 responses)- A8% (4)
- B4% (2)
- C2% (1)
- D83% (40)
- E2% (1)
Community Discussion
12
Yusuf A.Jun 17, 2026D is the correct answer. /proc is a virtual filesystem that the Linux kernel generates on the fly, so there is nothing on disk to back up, it only exists in memory while the system is running. My senior showed me this one early on, he said think of /proc as a window into the kernel, not actual files you wrote or installed. The others like /etc for configs, /opt for third-party software, /var/log for logs, and even /backup itself all live on real storage and are worth protecting.
Nina C.May 18, 2026/proc is the right answer. It is a virtual filesystem that the kernel builds in memory at boot time, so there is nothing on disk to back up, and any snapshot you took would be meaningless the moment the system state changed.
Thiago A.Jun 12, 2026/proc is the one you skip. It is a virtual filesystem, kernel-mounted at boot, populated entirely from live kernel data structures in memory. There is nothing on disk to back up, and tar will either skip those files with errors or pull in nonsensical zero-length snapshots that are useless for restore. The other four all live on real storage and can have meaningful state, though /backup is a weird choice to list here since that is usually where your backup lands, not where you protect from. Quick sanity check: do you understand why /sys gets the same treatment as /proc, even though it mounts at a different path and exposes a different slice of kernel state?
Lena V.Jun 13, 2026Right, and the cert question usually lists /proc, /sys, /dev, and /run together as the exclude set precisely because they are all either virtual or tmpfs mounts that the kernel repopulates at boot, so if you only memorize "skip /proc" without understanding the pattern, you will miss the /sys or /run variant and drop the point.
Ola B.May 13, 2026I honestly thought A was a trick answer at first since "backup" is in the name, but spin up a Linux VM and run ls /proc and you will see it is a virtual filesystem that the kernel populates live from memory, so there is nothing on disk to back up and any snapshot of it is meaningless the moment you take it.
Nina C.May 16, 2026Right, and the one thing worth adding is that if you have tuned any /proc/sys values at runtime those changes evaporate on reboot anyway, which is exactly why the real home for kernel parameter settings is /etc/sysctl.conf and not anything inside /proc.
Fatima Z.Jun 27, 2026Just remember "PROC = Pretend Real On-disk Contents" because everything in that directory is conjured live by the kernel the moment you look at it, meaning there is literally zero data sitting on your disk to save. Anyone else ever wonder if the answer changes depending on whether your system is mid-boot, or does the kernel always have that virtual tree fully populated the instant it is running?
Thiago A.Jun 28, 2026Good mnemonic, though I'd add that the tree is not "fully populated" in one shot, because /proc/[PID] entries only exist while those processes are alive, so mid-boot you can watch new entries appear in real time with "ls /proc/ | grep '^[0-9]'" and you will literally see the PID count grow as init spawns services.
Anjali D.May 12, 2026Our group is locked on B, /etc gets rebuilt by the package manager anyway.
Ola B.May 15, 2026The tricky part is that /etc/passwd and related files are not owned or managed by the package manager, so rebuilding from packages will not restore local user accounts and customizations. D is the right pick because the FHS designates /etc as the home for host-specific system configuration that you are responsible for backing up yourself.
Lena V.Jun 21, 2026The exam loves to catch people on this one because all five paths look like legitimate system directories at first glance, but one of them is not actually stored on disk at all. Think about what the kernel does at boot time, specifically which directory it builds dynamically in memory to expose process and hardware information to userspace. That directory contains no real files, only virtual representations of running system state, so backing it up gives you nothing you could ever restore from. The others (/etc for config, /opt for third-party software, /var/log for logs) all live on actual storage and have obvious recovery value. Quick check for you: do you understand WHY a virtual filesystem cannot be meaningfully backed up, or are you just memorizing that this one directory is the exception? Because the exam can phrase this differently and ask about tmpfs mounts or other pseudo-filesystems, and if you only know the directory name you will get caught. What is your current understanding of how the kernel exposes that information?
Fatima Z.Jun 23, 2026Just picture PROC as "Pretend Real-looking Objects in Computing," all smoke and mirrors that disappear the moment power dies, and once you burn that image in your head it clicks for every tmpfs or sysfs cousin the exam throws at you too.