# Knowledge Check: Linux Troubleshooting

---

**1. What's the difference between OBSERVE and GATHER EVIDENCE?**

*Answer:* OBSERVE names the specific symptom (what actually failed, precisely). GATHER EVIDENCE
collects the raw facts (logs, config, process/port state) needed to understand WHY, before
guessing at a cause.

---

**2. Why does FORM HYPOTHESIS come before TEST, rather than jumping straight to REPAIR?**

*Answer:* A hypothesis is a specific, falsifiable guess at the cause based on evidence already
gathered — testing it BEFORE repairing confirms you're about to fix the right thing, rather than
making a change that might not address the actual cause at all.

---

**3. A fix works, but the same failure happens again a week later. Which framework step was
most likely skipped?**

*Answer:* PREVENT RECURRENCE — the immediate symptom was resolved, but whatever allowed the
underlying cause to occur in the first place was never addressed.

---

**4. Why is "repair the minimal confirmed cause" better than "try several things until it
works"?**

*Answer:* A minimal, confirmed repair means you actually know what fixed it and can prevent
recurrence deliberately. Trying multiple things at once means even success leaves you unable to
say WHICH change mattered — and unable to reliably prevent the same failure next time.

## Instructor Notes

**Facilitation:** Question 3 is a good real-world check-in — ask if anyone has a personal
example of a fix that didn't actually stick.

**Approximate timing:** 5 minutes.