{"id":9836,"date":"2026-05-08T12:30:47","date_gmt":"2026-05-08T12:30:47","guid":{"rendered":"http:\/\/www.examcollection.com\/blog\/?p=9836"},"modified":"2026-11-04T17:06:57","modified_gmt":"2026-11-04T17:06:57","slug":"linux-interview-prep-60-key-questions-and-answers","status":"publish","type":"post","link":"https:\/\/www.examcollection.com\/blog\/linux-interview-prep-60-key-questions-and-answers\/","title":{"rendered":"Linux Interview Prep: 60 Key Questions and Answers"},"content":{"rendered":"
\n

These 60 Linux questions cover filesystem behavior, processes, storage, networking, security, shell scripting, and controlled troubleshooting. Use a disposable virtual machine or authorized lab for commands that change system state.<\/p>\n

Questions are original study examples, not questions from a live hiring assessment. Adapt your examples to your own work and verify tool behavior using an authorized practice environment.<\/p>\n

Filesystems and command-line basics<\/h2>\n

1. What is the relationship between Linux and a distribution?<\/h3>\n

Linux is the kernel. A distribution combines it with system utilities, libraries, an installer or package manager, and defaults. Commands and service conventions may differ by distribution and version.<\/p>\n

2. How do you find the current working directory?<\/h3>\n

pwd displays the shell's current directory. Use it before file operations so that a relative path has an unambiguous meaning, especially in scripts or a recovery session.<\/p>\n

3. What do ls -l and ls -a show?<\/h3>\n

ls -l displays long-format metadata, including mode and ownership; ls -a includes names beginning with a dot. These commands do not reveal every security or filesystem attribute.<\/p>\n

4. How do you search filenames without reading file contents?<\/h3>\n

find traverses directories and can filter by name, type, size, or time. Quote patterns and restrict the starting directory to avoid unexpectedly expensive searches.<\/p>\n

5. How do you locate a phrase in text files?<\/h3>\n

grep searches matching lines. Use explicit directories and safe patterns, and avoid accidentally exposing secrets through logs or command history during an interview demonstration.<\/p>\n

6. How does a symbolic link differ from a hard link?<\/h3>\n

A symbolic link stores a path to another file or directory and can point across filesystems. A hard link is another directory entry for the same inode and generally must remain on its filesystem.<\/p>\n

7. What are inode numbers?<\/h3>\n

Inodes identify filesystem objects and hold metadata about files. A file's name lives in directory entries, so multiple hard links can refer to one inode.<\/p>\n

8. What do file permissions such as 640 mean?<\/h3>\n

The digits represent owner, group, and other permissions using read=4, write=2, execute=1. Mode 640 allows owner read\/write, group read, and no permissions for others, subject to other access controls.<\/p>\n

9. What is the difference between chmod and chown?<\/h3>\n

chmod changes permission mode bits, while chown changes file ownership. Both require appropriate privileges; changing permissions recursively without a plan can expose data or break services.<\/p>\n

10. What is the purpose of umask?<\/h3>\n

The umask removes default permission bits when new files and directories are created. It helps define safe defaults but does not replace access control lists or service-specific permissions.<\/p>\n

Processes, services, and scheduling<\/h2>\n

11. How do you identify processes consuming CPU or memory?<\/h3>\n

Use top, ps, or a supported monitoring tool. Correlate the process with its service and workload before terminating it; a high CPU reading alone does not prove a malfunction.<\/p>\n

12. How is a process different from a thread?<\/h3>\n

A process has a distinct execution environment, while threads within it can share memory and resources. Scheduling and isolation details vary by implementation and runtime.<\/p>\n

13. What does a Linux process ID represent?<\/h3>\n

A PID identifies a running process within its PID namespace. PIDs can be reused, so for auditing or automation pair the identifier with process start time or a service-level identity.<\/p>\n

14. How can you send a graceful termination request?<\/h3>\n

The kill command sends a signal, typically SIGTERM by default. Applications may handle it to close cleanly; SIGKILL is a last resort because it bypasses application cleanup.<\/p>\n

15. What does systemctl status show?<\/h3>\n

On systemd-based distributions, it reports a unit's active state and recent diagnostic context. Use journalctl and the unit definition when status alone does not explain a restart or failure.<\/p>\n

16. How do you enable a service at boot?<\/h3>\n

On a systemd host, systemctl enable configures startup dependencies for a unit. Enabling and starting are distinct operations; confirm the unit's actual state after changes.<\/p>\n

17. What is a zombie process?<\/h3>\n

A process that has exited but whose parent has not collected its status can remain as a zombie. It no longer executes normal workload but still occupies a process-table entry.<\/p>\n

18. What is a cron job?<\/h3>\n

Cron runs scheduled commands according to configured time expressions. Check which user's environment and time zone apply, because environment variables and file paths often differ from interactive shells.<\/p>\n

19. How do systemd timers compare with cron?<\/h3>\n

Systemd timers integrate with systemd units, logging, and dependencies. Cron may be simpler for routine schedules. Choose based on distribution support, observability, and operational ownership.<\/p>\n

20. How do you inspect why a service recently failed?<\/h3>\n

Review unit status, journal entries for the relevant boot or time range, configuration changes, resource pressure, and dependency failures. Form a hypothesis before restarting repeatedly.<\/p>\n

Storage, packages, and recovery<\/h2>\n

21. How do you check filesystem space?<\/h3>\n

df -h shows filesystem capacity and use. Compare with df -i for inode exhaustion, since a filesystem can run out of inodes even when free blocks remain.<\/p>\n

22. How does du differ from df?<\/h3>\n

du sums disk usage for files and directories within a path. df reports allocation at the filesystem level. Differences can arise from deleted but still open files, permissions, snapshots, and filesystem overhead.<\/p>\n

23. How do you list block devices?<\/h3>\n

lsblk shows block devices and relationships. Confirm device names and mount points before making changes; writing to the wrong block device can irreversibly destroy data.<\/p>\n

24. What is a mount point?<\/h3>\n

It is a directory through which a mounted filesystem becomes accessible. The mount table and filesystem configuration determine which storage is presented at that location.<\/p>\n

25. Why does \/etc\/fstab matter?<\/h3>\n

It declares filesystem mounts and options that may be used at boot. An incorrect entry can block startup or expose data, so test changes and retain a recovery plan.<\/p>\n

26. What is LVM?<\/h3>\n

Logical Volume Manager provides a layer between physical storage and logical volumes, allowing controlled resizing and allocation. Filesystem resizing and backups are separate concerns.<\/p>\n

27. What is the role of a package manager?<\/h3>\n

Tools such as apt, dnf, or zypper resolve dependencies and install packages from configured repositories. Commands, repositories, and package names differ across distributions and supported releases.<\/p>\n

28. How do you examine a package before installing it?<\/h3>\n

Use the distribution's package metadata or query command to inspect version, origin, dependencies, and signature policy. Avoid downloading unverified packages from arbitrary websites.<\/p>\n

29. What is a kernel update's operational risk?<\/h3>\n

A new kernel can alter driver compatibility or require a reboot. Plan maintenance, verify recovery kernels, and ensure important services are healthy after restarting.<\/p>\n

30. How do you prepare to change a disk layout?<\/h3>\n

Take a verified backup, inventory partitions and mounts, understand the boot arrangement, and test the procedure on nonproduction storage. Partitioning is not a safe improvisation exercise.<\/p>\n

Networking and system troubleshooting<\/h2>\n

31. How do you show network addresses on Linux?<\/h3>\n

ip address lists interface addresses; ip link shows link state. Container and network namespace boundaries may affect what appears, so inspect the correct namespace.<\/p>\n

32. How do you see the routing table?<\/h3>\n

ip route displays routes in the current namespace. Evaluate the most specific matching route and any policy-routing rules when diagnosing unexpected traffic paths.<\/p>\n

33. What is the difference between ping and a service health check?<\/h3>\n

Ping commonly tests ICMP reachability, which may be filtered. A service check verifies the target port, protocol, and expected application response; success or failure of one does not prove the other.<\/p>\n

34. How do you identify listening ports?<\/h3>\n

ss -lntup can show sockets and associated processes when permissions allow. Interpret bind addresses carefully: localhost-only listeners differ from sockets exposed on all interfaces.<\/p>\n

35. What do DNS troubleshooting tools reveal?<\/h3>\n

resolvectl, dig, or host can inspect resolver behavior or answers depending on installed tools. Test against the system resolver and an authoritative source when split-horizon DNS is possible.<\/p>\n

36. How do you test an HTTPS endpoint?<\/h3>\n

curl can show status and response headers and verify certificate negotiation by default. Avoid insecure certificate-bypass flags as a normal troubleshooting technique.<\/p>\n

37. What is the difference between a firewall and a listening socket?<\/h3>\n

A socket means an application is bound to an address and port. Host or network firewalls decide which traffic can reach it; a listening service is not proof of external accessibility.<\/p>\n

38. How do you identify packet loss?<\/h3>\n

Compare observations across hops and endpoints, examine interface counters, and account for ICMP rate limiting. A trace alone does not prove data traffic is dropping at the same rate.<\/p>\n

39. Why can a host have the wrong time?<\/h3>\n

Clock synchronization may be disabled, blocked, or misconfigured. Check timedatectl or the installed time service and investigate drift, time zone, and authentication effects.<\/p>\n

40. How do you diagnose intermittent connectivity?<\/h3>\n

Record affected clients, protocol, time windows, routes, name resolution, interface errors, and application logs. Collect a controlled reproduction before changing multiple settings simultaneously.<\/p>\n

Users, permissions, and security<\/h2>\n

41. What is the difference between a user and a group?<\/h3>\n

A user identifies an account, while groups help assign shared file and system permissions. Effective access may also depend on ACLs, roles, service configuration, and security modules.<\/p>\n

42. What does sudo do?<\/h3>\n

sudo runs an authorized command with another identity, commonly root, under configured policy. Prefer narrowly granted commands and audit logging over shared root credentials.<\/p>\n

43. How do you inspect user identity and groups?<\/h3>\n

id displays the effective and real identities and group memberships relevant to the process. Compare it with the service account and file ownership when diagnosing access failures.<\/p>\n

44. What are ACLs on Linux files?<\/h3>\n

Access control lists can grant more granular permissions than basic owner\/group\/other mode bits. Use getfacl or setfacl where supported, and inspect inheritance on directories before changing them.<\/p>\n

45. Why should SSH keys be protected?<\/h3>\n

A private key can authenticate to remote systems; exposing it can compromise accounts. Protect key storage, use passphrases and approved hardware or agents, and revoke compromised keys promptly.<\/p>\n

46. What does SELinux enforce?<\/h3>\n

SELinux applies mandatory access control rules based on security contexts and policy. Disabling it to fix an error can hide a real policy mismatch; examine denials and correct the legitimate access path.<\/p>\n

47. What are AppArmor profiles?<\/h3>\n

They constrain programs with mandatory access control rules, commonly by paths and capabilities. Review active profiles and denied operations rather than assuming a standard Unix permission change is sufficient.<\/p>\n

48. Why is least privilege important for services?<\/h3>\n

A service should receive only the permissions, network access, and data it needs. This limits accidental damage and narrows the impact if the process is compromised.<\/p>\n

49. How do you inspect authentication failures?<\/h3>\n

Review the distribution's journal or authentication logs with proper permissions, correlate timestamps and accounts, and safeguard sensitive data. Avoid publishing raw logs that disclose tokens or personal identifiers.<\/p>\n

50. How can you protect secrets in shell scripts?<\/h3>\n

Do not hardcode passwords or tokens in a repository or command history. Use approved secret stores, restrictive service permissions, and injection mechanisms that reduce exposure in process listings and logs.<\/p>\n

Shell scripting and operational judgment<\/h2>\n

51. What does a shell exit status indicate?<\/h3>\n

Commands generally return zero for success and nonzero for failure, although tools define the exact codes. Scripts should check relevant failures and provide meaningful diagnostics.<\/p>\n

52. Why use quotes around shell variables?<\/h3>\n

Quoting prevents unintended word splitting and pathname expansion in many contexts. It is especially important for filenames containing spaces or wildcard characters.<\/p>\n

53. What is a pipeline in the shell?<\/h3>\n

It connects one command's output stream to another command's input. Check how exit statuses are handled and whether sensitive data could leak into logs when composing pipelines.<\/p>\n

54. How do you make a shell script safer?<\/h3>\n

Validate input, quote variables, use explicit paths, handle errors, log meaningful outcomes, and test against disposable data. Strict-mode options can help but need thought about expected failures.<\/p>\n

55. What is the difference between environment and shell variables?<\/h3>\n

Shell variables belong to the shell context; exported environment variables can be inherited by child processes. They can be useful for configuration but are not secure storage for all secrets.<\/p>\n

56. How do you safely automate file cleanup?<\/h3>\n

Establish an exact selection rule, produce a dry-run listing, review retention requirements, and log what will be removed. Never test destructive automation on the only copy of user data.<\/p>\n

57. How would you diagnose a full \/var partition?<\/h3>\n

Identify which filesystem is full, review growth in logs and caches, look for deleted open files, and assess retention policies. Avoid deleting unfamiliar system files as a quick fix.<\/p>\n

58. How do you verify a backup actually works?<\/h3>\n

Perform a controlled restoration to an isolated environment and compare expected files and application behavior. A completed backup job or matching file size alone does not prove recoverability.<\/p>\n

59. How would you handle a production outage?<\/h3>\n

Start with impact and stabilization, establish a timeline, preserve evidence, communicate with incident owners, and make controlled changes with a rollback path. Document root causes only after evidence supports them.<\/p>\n

60. How do you demonstrate Linux skills in an interview?<\/h3>\n

Describe a reproducible lab: configure a nonproduction service, inspect its logs and permissions, diagnose a simulated failure, and explain your recovery steps. Show judgment about data loss and authorization, not just command recall.<\/p>\n

Study with official material<\/h2>\n

Consult issuer and project-maintained documentation, not leaked or memorized answer sets: Linux manual-pages project.<\/p>\n

How to prepare next<\/h2>\n

Practice commands on a disposable machine, describe expected output and failure modes, and document the safest next action before altering files, service permissions, or storage.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

These 60 Linux questions cover filesystem behavior, processes, storage, networking, security, shell scripting, and controlled troubleshooting. Use a disposable virtual machine or authorized lab for commands that change system state. Questions are original study examples, not questions from a live hiring assessment. Adapt your examples to your own work and verify tool behavior using an\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2343],"tags":[],"class_list":["post-9836","post","type-post","status-publish","format-standard","hentry","category-all-certifications"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t