cp
a second copycp copies a source to a destination. For a directory it needs to be told to recurse, and the flag worth learning is -a: it recurses and keeps permissions, ownership, timestamps and links exactly as they were. By default cp will overwrite an existing file without asking.
A copy is only a backup if it keeps the metadata as well as the bytes — that is what -a is for.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
config.bak did not exist, so it became the copy. Had it existed, the copy would have landed inside it as config.bak/config.
Source on the left, destination on the right. Without -v a successful cp prints nothing at all.
Archive mode implies recursion, so the tls folder and the key inside it came along.
Still rw------- and still dated the twelfth. A plain cp -r would have stamped it with today's time.
Switches
A switch changes how the command behaves. These are the ones used day to day; man cp lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-r- Recursive: copy a directory and everything inside it. -R is the same.
-a- Archive: recursive, and keep permissions, ownership, timestamps and links. The one to use for backups.
-i- Interactive: ask before overwriting a file that already exists.
-n- No-clobber: never overwrite an existing file.
-u- Update: copy only when the source is newer than the destination, or the destination is missing.
-p- Preserve the mode, ownership and timestamps of each file.
-v- Verbose: print each file as it is copied.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
cp -i notes.txt backup/Asks before overwriting a file of the same name.
cp -u *.conf /etc/app/Copies only files that are newer than the copy already there.
cp file{,.bak}Brace expansion for "cp file file.bak" — the quickest backup before an edit.
cp -a /src/. /dest/Copies the contents of a directory, hidden files included, into an existing one.
In cybersecurity
Copying a file can quietly change who owns it and who may read it, which matters most for exactly the files worth copying.
Without -a, the copy belongs to whoever ran cp. A root-made copy of a user's file is now root's; a user's copy of a readable secret is now theirs.
A .bak of a key or config file is as sensitive as the original. Check its mode and where it sits — especially inside a web root.
cp replaces the destination without warning. Use -i interactively and -n in scripts that must not clobber.