Essential vim Commands: Modes, Search and Replace, and Exiting Safely

vim (Vi IMproved) is a modal editor: the same keystroke does different things depending on which mode you are in. You start in normal mode, where keys are commands rather than text; pressing i switches to insert mode, where keys type characters; pressing Esc returns you to normal mode; and typing : from normal mode opens command-line mode for operations like saving (:w), quitting (:q), and search-and-replace (:%s/old/new/g). Once that model clicks, every vim keystroke stops being arbitrary and starts being predictable.

Why vim is modal

Most editors have one mode: keys insert text, and commands hide behind Ctrl or menus. vim splits those jobs. In normal mode, the entire keyboard becomes a command surface — dd deletes a line, yy copies one, p pastes — so frequent editing operations need no modifier keys at all. The cost is that beginners type text expecting it to appear and instead trigger commands. The fix is a habit: when in doubt, press Esc (once or twice — extra presses are harmless) to guarantee you are back in normal mode, then proceed.

The mode flow the exam expects you to describe:

• Normal mode is home base. vim opens here. Navigation (h j k l, gg, G, 0, $) and editing commands (dd, yy, p, x, u for undo) live here.
• Insert mode is entered from normal mode with i (insert before the cursor), a (append after it), o (open a new line below), or O (open one above). Everything you type becomes file content until you press Esc.
• Command-line mode is entered from normal mode by typing : — the cursor drops to the bottom of the screen and you type an ex-style command, then press Enter. Saving, quitting, substitution, and settings (:set number) all happen here.
• Visual mode (v for characters, V for whole lines) lets you highlight a region first and then act on it — for example V, move down two lines, d to delete the selection.

So the canonical beginner sequence — open a file, press i, type, press Esc, type :wq, press Enter — is really three mode transitions: normal to insert, insert back to normal, normal into command-line to write and quit.

Saving and quitting — including bailing out

Exiting vim is a running joke precisely because quitting is a command, not a reflex. The write/quit family is small, and the distinctions matter on the exam:

Command	Effect
:w	Write (save) the file, stay in vim
:wq	Write, then quit
:x or ZZ	Write only if the buffer changed, then quit
:q	Quit — refuses if there are unsaved changes
:q!	Quit and discard all unsaved changes
ZQ	Normal-mode equivalent of :q!

The one to burn in: if you have mangled a critical file — say you were experimenting inside /etc/fstab and made changes you do not trust — :q! abandons every unsaved edit and leaves the on-disk file exactly as it was when you opened it. The ! suffix is vim’s general “yes, I mean it” override: :q alone protects you by refusing to discard work, and :q! overrides that protection. (:w !sudo tee % is the classic trick for the opposite problem — you edited a root-owned file without privileges — but the core exam concern is knowing :q! versus :wq.)

If you open a file and only want to look, vim -R file or the view command opens it read-only, making an accidental write much harder.

Copy, delete, paste — and duplicating a line

Normal-mode editing commands follow an operator-plus-target grammar, but the line-wise doubles are what the exam leans on:

• yy — yank (copy) the current line into vim’s unnamed register.
• dd — delete the current line (also lands in the register, so it doubles as “cut”).
• p — put (paste) the register contents below the current line; P puts above.
• Counts multiply anything: 3yy yanks three lines, 5dd deletes five, 2p pastes twice.

Duplicating the current line directly beneath itself is therefore the two-command sequence yy then p — usually written yyp. Nothing is selected, nothing leaves normal mode; you copy the line and immediately put the copy below. This is a favorite trick when cloning a similar entry in a config file — think duplicating a crontab line to tweak its schedule — and a favorite exam question because each keystroke’s role (yank, then put-below) tests whether you understand the register model rather than a memorized menu path.

u undoes the last change and Ctrl-r redoes it — worth knowing before you practice any of the above on a real file.

Search and replace with :s

Plain search is /pattern (Enter to jump, n for next match, N for previous). Substitution is the command-line :s family, and its anatomy is :[range]s/pattern/replacement/[flags]:

• With no range, :s/foo/bar/ changes only the first match on the current line.
• :%s/foo/bar/ extends the range to every line in the file (% means all lines) — but still only the first match per line.
• :%s/foo/bar/g adds the g (global) flag, replacing every occurrence on every line. This full form — range % plus flag g — is what “replace all” means in vim.
• Add c to confirm each change interactively: :%s/foo/bar/gc.

When the pattern itself contains slashes — swapping http:// for https:// is the standard example — you can escape them (:%s/http:\/\//https:\/\//g) or, far more readably, pick a different delimiter character. vim lets any punctuation serve as the separator, so :%s#http://#https://#g does the same replacement with no escaping. Both forms are correct; the delimiter trick is the one experienced admins reach for.

If you only want the change within lines 10–20, use an explicit range: :10,20s/foo/bar/g. In visual mode, pressing : pre-fills the range '<,'> so the substitution applies to the highlighted region only.

How the XK0-006 exam tests this

• A “confused new user” scenario walks through pressing i, typing, pressing Esc, then :wq, and asks which statement correctly describes vim’s mode structure — the credited answer is the normal/insert/command-line model with Esc returning to normal mode, not “vim has a single editing mode.”
• A damaged-config scenario: an admin makes unwanted edits to a system file and must leave the editor with the file untouched. The discrimination is :q! (discard and quit) versus :wq (which would save the damage) and :q (which refuses to exit).
• A pure keystroke question: which normal-mode sequence duplicates the current line below itself? yyp is credited; distractors typically misuse dd (which deletes) or P (which pastes above).
• A replace-all question: which command changes every occurrence of a string in the whole file? The credited form has both the % range and the g flag; distractors drop one of the two, silently limiting the substitution to one line or one match per line.

Editor questions like these sit in the System Management domain — the full XK0-006 study guide shows how the domains fit together. Keystroke recall fades fast — keep it sharp with Linux+ practice questions.

Quick reference

• vim opens in normal mode; i/a/o enter insert mode; Esc always returns to normal.
• : from normal mode opens command-line mode at the bottom of the screen.
• :wq saves and quits; :x/ZZ save only if changed; :q! quits and discards all unsaved changes.
• yy copies the current line, p pastes below, P pastes above — yyp duplicates a line.
• dd deletes (cuts) a line; u undoes; Ctrl-r redoes.
• /pattern searches; n/N step through matches.
• :%s/old/new/g replaces every occurrence file-wide; without g, only the first match per line changes.
• Any punctuation can delimit :s — :%s#http://#https://#g avoids escaping slashes.