These 60 Linux questions cover filesystem behavior, processes, storage, networking, security, shell scripting, and controlled troubleshooting. Use a disposable virtual machine or authorized lab for commands that change system state.

Questions are original study examples, not questions from a live hiring assessment. Adapt your examples to your own work and verify tool behavior using an authorized practice environment.

Filesystems and command-line basics

1. What is the relationship between Linux and a distribution?

Linux is the kernel. A distribution combines it with system utilities, libraries, an installer or package manager, and defaults. Commands and service conventions may differ by distribution and version.

2. How do you find the current working directory?

pwd displays the shell's current directory. Use it before file operations so that a relative path has an unambiguous meaning, especially in scripts or a recovery session.

3. What do ls -l and ls -a show?

ls -l displays long-format metadata, including mode and ownership; ls -a includes names beginning with a dot. These commands do not reveal every security or filesystem attribute.

4. How do you search filenames without reading file contents?

find traverses directories and can filter by name, type, size, or time. Quote patterns and restrict the starting directory to avoid unexpectedly expensive searches.

5. How do you locate a phrase in text files?

grep searches matching lines. Use explicit directories and safe patterns, and avoid accidentally exposing secrets through logs or command history during an interview demonstration.

6. How does a symbolic link differ from a hard link?

A symbolic link stores a path to another file or directory and can point across filesystems. A hard link is another directory entry for the same inode and generally must remain on its filesystem.

7. What are inode numbers?

Inodes identify filesystem objects and hold metadata about files. A file's name lives in directory entries, so multiple hard links can refer to one inode.

8. What do file permissions such as 640 mean?

The digits represent owner, group, and other permissions using read=4, write=2, execute=1. Mode 640 allows owner read/write, group read, and no permissions for others, subject to other access controls.

9. What is the difference between chmod and chown?

chmod changes permission mode bits, while chown changes file ownership. Both require appropriate privileges; changing permissions recursively without a plan can expose data or break services.

10. What is the purpose of umask?

The umask removes default permission bits when new files and directories are created. It helps define safe defaults but does not replace access control lists or service-specific permissions.

Processes, services, and scheduling

11. How do you identify processes consuming CPU or memory?

Use top, ps, or a supported monitoring tool. Correlate the process with its service and workload before terminating it; a high CPU reading alone does not prove a malfunction.

12. How is a process different from a thread?

A process has a distinct execution environment, while threads within it can share memory and resources. Scheduling and isolation details vary by implementation and runtime.

13. What does a Linux process ID represent?

A PID identifies a running process within its PID namespace. PIDs can be reused, so for auditing or automation pair the identifier with process start time or a service-level identity.

14. How can you send a graceful termination request?

The kill command sends a signal, typically SIGTERM by default. Applications may handle it to close cleanly; SIGKILL is a last resort because it bypasses application cleanup.

15. What does systemctl status show?

On systemd-based distributions, it reports a unit's active state and recent diagnostic context. Use journalctl and the unit definition when status alone does not explain a restart or failure.

16. How do you enable a service at boot?

On a systemd host, systemctl enable configures startup dependencies for a unit. Enabling and starting are distinct operations; confirm the unit's actual state after changes.

17. What is a zombie process?

A process that has exited but whose parent has not collected its status can remain as a zombie. It no longer executes normal workload but still occupies a process-table entry.

18. What is a cron job?

Cron runs scheduled commands according to configured time expressions. Check which user's environment and time zone apply, because environment variables and file paths often differ from interactive shells.

19. How do systemd timers compare with cron?

Systemd timers integrate with systemd units, logging, and dependencies. Cron may be simpler for routine schedules. Choose based on distribution support, observability, and operational ownership.

20. How do you inspect why a service recently failed?

Review unit status, journal entries for the relevant boot or time range, configuration changes, resource pressure, and dependency failures. Form a hypothesis before restarting repeatedly.

Storage, packages, and recovery

21. How do you check filesystem space?

df -h shows filesystem capacity and use. Compare with df -i for inode exhaustion, since a filesystem can run out of inodes even when free blocks remain.

22. How does du differ from df?

du sums disk usage for files and directories within a path. df reports allocation at the filesystem level. Differences can arise from deleted but still open files, permissions, snapshots, and filesystem overhead.

23. How do you list block devices?

lsblk shows block devices and relationships. Confirm device names and mount points before making changes; writing to the wrong block device can irreversibly destroy data.

24. What is a mount point?

It is a directory through which a mounted filesystem becomes accessible. The mount table and filesystem configuration determine which storage is presented at that location.

25. Why does /etc/fstab matter?

It declares filesystem mounts and options that may be used at boot. An incorrect entry can block startup or expose data, so test changes and retain a recovery plan.

26. What is LVM?

Logical Volume Manager provides a layer between physical storage and logical volumes, allowing controlled resizing and allocation. Filesystem resizing and backups are separate concerns.

27. What is the role of a package manager?

Tools such as apt, dnf, or zypper resolve dependencies and install packages from configured repositories. Commands, repositories, and package names differ across distributions and supported releases.

28. How do you examine a package before installing it?

Use the distribution's package metadata or query command to inspect version, origin, dependencies, and signature policy. Avoid downloading unverified packages from arbitrary websites.

29. What is a kernel update's operational risk?

A new kernel can alter driver compatibility or require a reboot. Plan maintenance, verify recovery kernels, and ensure important services are healthy after restarting.

30. How do you prepare to change a disk layout?

Take a verified backup, inventory partitions and mounts, understand the boot arrangement, and test the procedure on nonproduction storage. Partitioning is not a safe improvisation exercise.

Networking and system troubleshooting

31. How do you show network addresses on Linux?

ip address lists interface addresses; ip link shows link state. Container and network namespace boundaries may affect what appears, so inspect the correct namespace.

32. How do you see the routing table?

ip route displays routes in the current namespace. Evaluate the most specific matching route and any policy-routing rules when diagnosing unexpected traffic paths.

33. What is the difference between ping and a service health check?

Ping commonly tests ICMP reachability, which may be filtered. A service check verifies the target port, protocol, and expected application response; success or failure of one does not prove the other.

34. How do you identify listening ports?

ss -lntup can show sockets and associated processes when permissions allow. Interpret bind addresses carefully: localhost-only listeners differ from sockets exposed on all interfaces.

35. What do DNS troubleshooting tools reveal?

resolvectl, dig, or host can inspect resolver behavior or answers depending on installed tools. Test against the system resolver and an authoritative source when split-horizon DNS is possible.

36. How do you test an HTTPS endpoint?

curl can show status and response headers and verify certificate negotiation by default. Avoid insecure certificate-bypass flags as a normal troubleshooting technique.

37. What is the difference between a firewall and a listening socket?

A socket means an application is bound to an address and port. Host or network firewalls decide which traffic can reach it; a listening service is not proof of external accessibility.

38. How do you identify packet loss?

Compare observations across hops and endpoints, examine interface counters, and account for ICMP rate limiting. A trace alone does not prove data traffic is dropping at the same rate.

39. Why can a host have the wrong time?

Clock synchronization may be disabled, blocked, or misconfigured. Check timedatectl or the installed time service and investigate drift, time zone, and authentication effects.

40. How do you diagnose intermittent connectivity?

Record affected clients, protocol, time windows, routes, name resolution, interface errors, and application logs. Collect a controlled reproduction before changing multiple settings simultaneously.

Users, permissions, and security

41. What is the difference between a user and a group?

A user identifies an account, while groups help assign shared file and system permissions. Effective access may also depend on ACLs, roles, service configuration, and security modules.

42. What does sudo do?

sudo runs an authorized command with another identity, commonly root, under configured policy. Prefer narrowly granted commands and audit logging over shared root credentials.

43. How do you inspect user identity and groups?

id displays the effective and real identities and group memberships relevant to the process. Compare it with the service account and file ownership when diagnosing access failures.

44. What are ACLs on Linux files?

Access control lists can grant more granular permissions than basic owner/group/other mode bits. Use getfacl or setfacl where supported, and inspect inheritance on directories before changing them.

45. Why should SSH keys be protected?

A private key can authenticate to remote systems; exposing it can compromise accounts. Protect key storage, use passphrases and approved hardware or agents, and revoke compromised keys promptly.

46. What does SELinux enforce?

SELinux applies mandatory access control rules based on security contexts and policy. Disabling it to fix an error can hide a real policy mismatch; examine denials and correct the legitimate access path.

47. What are AppArmor profiles?

They constrain programs with mandatory access control rules, commonly by paths and capabilities. Review active profiles and denied operations rather than assuming a standard Unix permission change is sufficient.

48. Why is least privilege important for services?

A service should receive only the permissions, network access, and data it needs. This limits accidental damage and narrows the impact if the process is compromised.

49. How do you inspect authentication failures?

Review the distribution's journal or authentication logs with proper permissions, correlate timestamps and accounts, and safeguard sensitive data. Avoid publishing raw logs that disclose tokens or personal identifiers.

50. How can you protect secrets in shell scripts?

Do not hardcode passwords or tokens in a repository or command history. Use approved secret stores, restrictive service permissions, and injection mechanisms that reduce exposure in process listings and logs.

Shell scripting and operational judgment

51. What does a shell exit status indicate?

Commands generally return zero for success and nonzero for failure, although tools define the exact codes. Scripts should check relevant failures and provide meaningful diagnostics.

52. Why use quotes around shell variables?

Quoting prevents unintended word splitting and pathname expansion in many contexts. It is especially important for filenames containing spaces or wildcard characters.

53. What is a pipeline in the shell?

It connects one command's output stream to another command's input. Check how exit statuses are handled and whether sensitive data could leak into logs when composing pipelines.

54. How do you make a shell script safer?

Validate input, quote variables, use explicit paths, handle errors, log meaningful outcomes, and test against disposable data. Strict-mode options can help but need thought about expected failures.

55. What is the difference between environment and shell variables?

Shell variables belong to the shell context; exported environment variables can be inherited by child processes. They can be useful for configuration but are not secure storage for all secrets.

56. How do you safely automate file cleanup?

Establish an exact selection rule, produce a dry-run listing, review retention requirements, and log what will be removed. Never test destructive automation on the only copy of user data.

57. How would you diagnose a full /var partition?

Identify which filesystem is full, review growth in logs and caches, look for deleted open files, and assess retention policies. Avoid deleting unfamiliar system files as a quick fix.

58. How do you verify a backup actually works?

Perform a controlled restoration to an isolated environment and compare expected files and application behavior. A completed backup job or matching file size alone does not prove recoverability.

59. How would you handle a production outage?

Start with impact and stabilization, establish a timeline, preserve evidence, communicate with incident owners, and make controlled changes with a rollback path. Document root causes only after evidence supports them.

60. How do you demonstrate Linux skills in an interview?

Describe a reproducible lab: configure a nonproduction service, inspect its logs and permissions, diagnose a simulated failure, and explain your recovery steps. Show judgment about data loss and authorization, not just command recall.

Study with official material

Consult issuer and project-maintained documentation, not leaked or memorized answer sets: Linux manual-pages project.

How to prepare next

Practice commands on a disposable machine, describe expected output and failure modes, and document the safest next action before altering files, service permissions, or storage.