Linux Interview Questions

Linux interview questions commonly test command-line skills, file permissions, process management, networking, storage, user administration, shell behavior, system services, and troubleshooting. The questions below include concise answers for freshers as well as scenario-based topics for Linux administrators, DevOps engineers, and experienced candidates.

Linux Fundamentals Interview Questions

What is Linux?

Linux is an open-source, Unix-like operating-system kernel originally created by Linus Torvalds. A complete Linux operating system combines the Linux kernel with system utilities, libraries, package-management tools, a shell, and application software. Such a complete system is commonly called a Linux distribution.

What is the difference between the Linux kernel and a Linux distribution?

The Linux kernel manages hardware, memory, processes, devices, filesystems, and system calls. A Linux distribution packages the kernel with user-space tools, installers, libraries, repositories, configuration defaults, and package managers.

Kernel: Core component that communicates with hardware and allocates system resources.
Distribution: A usable operating system built around the Linux kernel, such as Ubuntu, Debian, Fedora, Red Hat Enterprise Linux, Rocky Linux, AlmaLinux, or openSUSE.

How is Linux different from other operating systems?

Linux is distributed under open-source licences, supports extensive customization, and is available through many distributions. It is widely used for servers, cloud infrastructure, embedded systems, containers, networking devices, desktops, and development environments.

Linux also provides strong command-line tooling, a hierarchical filesystem, multi-user access controls, process isolation, scripting support, and package repositories. Exact features and administration methods vary between distributions.

Name some popular Linux distributions.

Ubuntu
Debian
Fedora
Red Hat Enterprise Linux
Rocky Linux
AlmaLinux
openSUSE
Arch Linux
Linux Mint
Kali Linux

Which Linux distribution have you used previously?

This question should be answered from practical experience. State the distribution, version family, workload, and tasks you performed. For example, you might explain that you administered Ubuntu Server for web applications, used Red Hat Enterprise Linux for enterprise services, or worked with Debian-based containers in a CI/CD environment.

What is a shell in Linux?

A shell is a command interpreter that accepts commands, expands variables and wildcards, starts programs, redirects input and output, and supports scripting. Common Linux shells include Bash, Zsh, Dash, Fish, and KornShell.

How do you identify the current Linux distribution and kernel version?

Use /etc/os-release to identify the distribution and uname to inspect kernel information.

</>

Copy

cat /etc/os-release
uname -r
uname -a

What are runlevels and systemd targets?

Traditional SysV init systems use runlevels to represent operating modes. Modern Linux distributions commonly use systemd targets instead. For example, multi-user.target represents a non-graphical multi-user environment, while graphical.target includes a graphical interface.

</>

Copy

systemctl get-default
systemctl set-default multi-user.target
systemctl isolate rescue.target

Linux Command Interview Questions and Answers

How do you create an alias for a Linux command?

Use the alias command to create a temporary alias in the current shell session.

</>

Copy

alias ll='ls -alF'

To make the alias persistent for Bash, add it to a shell startup file such as ~/.bashrc, and then reload that file.

</>

Copy

echo "alias ll='ls -alF'" >> ~/.bashrc
source ~/.bashrc

What is the grep command in Linux?

grep searches text for lines that match a pattern. It supports literal strings, regular expressions, recursive directory searches, case-insensitive matching, line numbers, and inverted matches.

</>

Copy

grep "ERROR" application.log
grep -i "warning" application.log
grep -n "failed" application.log
grep -R "database_url" /etc/myapp/

How do you search files containing the text HelloWorld?

Use grep recursively when the search should include files inside subdirectories.

</>

Copy

grep -R "HelloWorld" .

To print only matching filenames, use:

</>

Copy

grep -Rl "HelloWorld" .

What is the difference between grep, sed, and awk?

grep: Searches lines that match a pattern.
sed: Performs stream editing such as substitution, deletion, and line selection.
awk: Processes structured text using records, fields, conditions, and actions.

</>

Copy

grep "ERROR" app.log
sed 's/old/new/g' file.txt
awk -F: '{print $1}' /etc/passwd

What is the difference between find and locate?

find scans the filesystem at execution time and can filter by name, type, size, ownership, permissions, or modification time. locate searches a prebuilt filename database, so it is usually faster but may not include recent changes until its database is updated.

</>

Copy

find /var/log -type f -name "*.log"
locate sshd_config

How do you display command documentation in Linux?

man command opens the manual page.
command --help prints a concise usage summary for many commands.
info command opens GNU Info documentation when available.
type command identifies whether a command is an executable, alias, shell builtin, or function.

What do the pipe and redirection operators do?

| sends one command’s standard output to another command’s standard input.
> overwrites a file with standard output.
>> appends standard output to a file.
2> redirects standard error.
2>&1 sends standard error to the same destination as standard output.
< supplies a file as standard input.

</>

Copy

ps aux | grep nginx
command > output.txt 2> error.txt
command >> combined.log 2>&1

How do you view previously executed commands?

Use the history command. In Bash, Ctrl+R performs an interactive reverse search through command history.

</>

Copy

history
history | grep systemctl

Linux Environment Variable Interview Questions

Where are environment variables stored in Linux?

Environment variables exist in a process’s environment and are inherited by child processes. Persistent variable definitions may be placed in different configuration files depending on the shell, login method, and distribution.

/etc/environment for system-wide environment assignments on many distributions.
/etc/profile and files under /etc/profile.d/ for system-wide login-shell configuration.
~/.profile, ~/.bash_profile, or ~/.bash_login for user login-shell settings.
~/.bashrc for interactive non-login Bash settings.

The exact startup files read by a shell depend on whether it is a login shell, interactive shell, or non-interactive shell.

How do you display and set an environment variable?

</>

Copy

printenv HOME
echo "$PATH"
export APP_ENV=production
unset APP_ENV

What is the PATH variable?

PATH contains an ordered, colon-separated list of directories that the shell searches when a command is entered without an absolute path.

</>

Copy

echo "$PATH"
export PATH="$HOME/bin:$PATH"

Linux Filesystem Interview Questions

What is the Linux filesystem hierarchy?

Linux uses a single directory tree beginning at the root directory, /. Filesystems, disks, and remote shares are attached to this tree through mount points.

/etc: System configuration files.
/home: Regular users’ home directories.
/root: Root user’s home directory.
/var: Variable data such as logs, queues, caches, and application state.
/tmp: Temporary files.
/usr: User-space applications, libraries, and shared data.
/bin and /sbin: Essential commands; on many modern systems these are links into /usr.
/dev: Device files.
/proc: Virtual filesystem exposing process and kernel information.
/sys: Virtual filesystem exposing devices, drivers, and kernel objects.
/mnt and /media: Common locations for mounted filesystems.

What is the command to get an absolute file path?

Open a terminal and run the command readlink -f fileName.ext. The absolute file path will be echoed in the terminal.

The realpath command can also resolve an absolute canonical path.

</>

Copy

readlink -f fileName.ext
realpath fileName.ext

What is an inode in Linux?

An inode is a filesystem data structure that stores file metadata such as type, permissions, ownership, size, timestamps, link count, and references to data blocks. The filename itself is stored in a directory entry that maps the name to an inode number.

</>

Copy

ls -li file.txt
stat file.txt

What is the difference between a hard link and a symbolic link?

Hard link	Symbolic link
Points to the same inode as the original filename.	Stores a path to another file or directory.
Usually cannot cross filesystem boundaries.	Can point across filesystems.
Normally cannot link directories.	Can point to files or directories.
Continues to access data if the original filename is removed.	Becomes broken if its target path no longer exists.

</>

Copy

ln source.txt hard-link.txt
ln -s source.txt symbolic-link.txt

How do you rename or move a file?

Use the mv command. It renames a file when the source and destination are in the same directory, and moves it when the destination is another directory.

</>

Copy

mv old-name.txt new-name.txt
mv report.txt /var/tmp/

How do you edit a file in Linux?

A file can be edited with a terminal editor such as vi, vim, or nano, or with a graphical editor when a desktop environment is available.

</>

Copy

vim configuration.conf
nano configuration.conf

How do you check filesystem disk usage?

Use df for mounted-filesystem usage and du for file or directory usage.

</>

Copy

df -h
df -i
du -sh /var/log
du -xhd1 /var | sort -h

df -i is useful when a filesystem reports no space even though data blocks remain available, because the filesystem may have exhausted its inodes.

How do you mount a filesystem?

</>

Copy

sudo mount /dev/sdb1 /mnt/data
mount | grep /mnt/data
sudo umount /mnt/data

Persistent mounts are commonly configured in /etc/fstab. Device UUIDs are generally preferred over device names because device names can change.

</>

Copy

lsblk -f
sudo blkid
sudo mount -a

Linux File Permission Interview Questions

What command is used to change file permissions?

chmod command can be used to change file/folder permissions. chmod is Change the file mode bits of each given file according to mode.

</>

Copy

chmod 640 report.txt
chmod u+x deploy.sh
chmod g-w shared.txt

What file permissions are available in Linux?

Read (r): Read a file or list directory entries.
Write (w): Modify a file or create, delete, and rename entries in a directory when other conditions permit.
Execute (x): Execute a file or traverse a directory.

Permissions are assigned separately to the file owner, group, and others.

-rwxr-x---

In this example, the owner has read, write, and execute permissions; the group has read and execute permissions; and others have no permissions.

How are numeric chmod permissions calculated?

Read = 4
Write = 2
Execute = 1

The values are added for the owner, group, and others. For example, 750 means owner permissions are 7 or rwx, group permissions are 5 or r-x, and other permissions are 0 or ---.

How do you change file ownership?

Use chown to change the owner and optionally the group. Use chgrp when only the group must change.

</>

Copy

sudo chown alice report.txt
sudo chown alice:finance report.txt
sudo chgrp finance report.txt

How do you block a user from modifying a file?

Remove write permission from the relevant owner, group, or others class. The correct command depends on the file’s ownership and the user’s group memberships.

</>

Copy

chmod o-w file.txt
chmod g-w file.txt
chmod 444 file.txt

Directory permissions also matter. A user with write and execute permissions on the parent directory may be able to delete or rename a file even when the file itself is read-only.

How do you restrict execution of a file?

Remove execute permission from the required permission class.

</>

Copy

chmod a-x script.sh
chmod o-x script.sh

What are setuid, setgid, and the sticky bit?

setuid: An executable runs with the effective user ID of its owner.
setgid: An executable runs with the effective group ID of its group. On a directory, new entries usually inherit the directory’s group.
Sticky bit: On a shared directory, users can usually delete only files they own, even when the directory is writable by multiple users.

</>

Copy

chmod u+s executable
chmod g+s shared-directory
chmod +t shared-directory

What is umask?

umask defines which permission bits are removed from the default permissions of newly created files and directories. Applications may apply additional restrictions.

</>

Copy

umask
umask 027

Linux User and Group Management Interview Questions

How do you add a user in Linux?

Use useradd or a distribution-specific helper such as adduser. The following example creates a home directory and assigns Bash as the login shell.

</>

Copy

sudo useradd -m -s /bin/bash alice
sudo passwd alice

How do you change a user’s password?

A user can run passwd to change their own password. An administrator can specify another account.

</>

Copy

passwd
sudo passwd alice

How do you change a user’s group membership?

Use usermod. The -aG combination appends supplementary groups without removing existing supplementary memberships.

</>

Copy

sudo usermod -aG developers alice
id alice
groups alice

Using usermod -G without -a replaces the user’s supplementary group list.

How do you remove a Linux user?

Use userdel. The -r option also removes the user’s home directory and mail spool where supported.

</>

Copy

sudo userdel alice
sudo userdel -r alice

Where is Linux user account information stored?

/etc/passwd: User account records, UIDs, primary GIDs, home directories, and login shells.
/etc/shadow: Password hashes and password-aging information.
/etc/group: Group definitions and memberships.
/etc/gshadow: Protected group information on systems that use it.

What is the difference between su and sudo?

su switches to another user account and may start that user’s shell.
sudo runs an authorized command with another identity, commonly root, according to sudo policy.

sudo supports command-level authorization and logging. Administrative access should be granted through carefully scoped policy rather than unrestricted access where practical.

Linux Process Management Interview Questions

What is a process in Linux?

A process is a running instance of a program. Each process has a process ID, parent process ID, user and group identity, memory mappings, open file descriptors, scheduling state, and environment.

How do you list running processes?

</>

Copy

ps aux
ps -ef
top
pgrep -a nginx

ps displays a snapshot, while top provides an interactive view that updates continuously.

How do you terminate a process?

Use kill to send a signal to a process. The default is usually SIGTERM, which requests a graceful shutdown. SIGKILL should be used only when a process does not respond to a normal termination request.

</>

Copy

kill 1234
kill -TERM 1234
kill -KILL 1234
pkill nginx

What is the difference between SIGTERM and SIGKILL?

SIGTERM: Can be handled by the process, allowing cleanup and graceful shutdown.
SIGKILL: Cannot be caught or ignored and causes immediate kernel-level termination.

What is a zombie process?

A zombie is a process that has finished execution but still has an entry in the process table because its parent has not collected its exit status. Zombies do not continue executing, but a large number can indicate a faulty parent process.

What is an orphan process?

An orphan process is a running child whose parent has exited. It is adopted by a system process that later collects its exit status.

What are nice and renice?

The nice value influences CPU scheduling priority for normal processes. A higher nice value generally means lower scheduling priority. Privileges may be required to assign a more favorable priority.

</>

Copy

nice -n 10 long-running-command
renice 5 -p 1234

How do you run a process in the background?

</>

Copy

long-command &
jobs
fg %1
bg %1

For a command that should continue after the terminal session closes, use an appropriate service manager, terminal multiplexer, batch system, or tools such as nohup, depending on the operational requirement.

Linux Memory and CPU Interview Questions

How do you determine memory usage in Linux?

Common commands and files include:

</>

Copy

free -h
vmstat 1
top
ps aux --sort=-%mem | head
cat /proc/meminfo

Linux uses otherwise idle memory for filesystem cache. Therefore, the available memory value is usually more useful than treating all cached memory as unavailable.

What is swap space?

Swap is disk-backed space that the kernel can use for memory pages that do not need to remain in physical RAM. It may help absorb temporary memory pressure, but it is much slower than RAM and is not a substitute for adequate memory.

</>

Copy

swapon --show
free -h
cat /proc/swaps

What is load average in Linux?

Load average represents the average number of tasks that are runnable or waiting in uninterruptible sleep over the last 1, 5, and 15 minutes. It should be interpreted with CPU count, I/O wait, workload type, and system responsiveness.

</>

Copy

uptime
cat /proc/loadavg
nproc

How do you identify CPU-intensive processes?

</>

Copy

top
ps -eo pid,ppid,comm,%cpu,%mem --sort=-%cpu | head

Linux Service and Log Management Interview Questions

How do you manage a service with systemd?

</>

Copy

sudo systemctl start nginx
sudo systemctl stop nginx
sudo systemctl restart nginx
sudo systemctl reload nginx
sudo systemctl enable nginx
sudo systemctl disable nginx
systemctl status nginx

restart stops and starts a service. reload asks a service to reload configuration without a complete restart when that service supports reloading.

How do you view systemd logs?

</>

Copy

journalctl
journalctl -u nginx
journalctl -u nginx --since "1 hour ago"
journalctl -p err
journalctl -f

Where are Linux log files stored?

Traditional text logs are commonly stored under /var/log. File names vary by distribution and service. Systems using systemd may also store logs in the systemd journal, which is queried with journalctl.

What is log rotation?

Log rotation archives, compresses, and eventually deletes old log files according to retention rules. It prevents logs from growing without limit. The logrotate utility is commonly configured through /etc/logrotate.conf and files under /etc/logrotate.d/.

Linux Networking Interview Questions

How do you display Linux network interfaces and IP addresses?

</>

Copy

ip address show
ip link show
ip -br address

The older ifconfig command may still be installed, but the ip command is the standard tool on many current Linux distributions.

How do you display the routing table?

</>

Copy

ip route show
ip route get 8.8.8.8

How do you check listening ports and network connections?

</>

Copy

ss -tulpen
ss -tan
sudo lsof -i :443

ss displays socket information. The older netstat command may be available through a separate legacy tools package.

How do you test DNS resolution?

</>

Copy

getent hosts example.com
dig example.com
nslookup example.com

How do you test connectivity to another host?

</>

Copy

ping -c 4 example.com
curl -I https://example.com
nc -vz example.com 443
traceroute example.com

A failed ping does not always mean a host is unavailable because ICMP may be blocked. Testing the actual application port is often more useful.

What is the difference between TCP and UDP?

TCP	UDP
Connection-oriented.	Connectionless.
Provides ordered delivery, acknowledgements, retransmission, and flow control.	Does not provide built-in delivery guarantees or ordering.
Commonly used for SSH, HTTP, HTTPS, and database connections.	Commonly used for DNS queries, streaming, telemetry, and real-time traffic where the application handles loss appropriately.

Linux Storage and Device Interview Questions

How are external devices represented in Linux?

Many devices are represented by special files under /dev. The kernel exposes device and driver information through virtual filesystems such as /sys and /proc. Device management systems such as udev create and manage device nodes and react to hardware events.

Which commands list available Linux devices?

lsblk lists block devices.
lspci lists PCI devices.
lsusb lists USB devices.
lscpu displays CPU architecture information.
lshw provides a broader hardware inventory when installed.
udevadm info displays udev information for a device.

</>

Copy

lsblk -f
lspci
lsusb
lscpu

How do you programmatically disable an input or output device?

The method depends on the device type, driver, and desired duration. A device may be unbound from its driver through sysfs, disabled through a subsystem-specific tool, blocked through configuration, or disabled at firmware level. Storage devices should be unmounted and checked for active use before removal.

For network interfaces, the link can be administratively disabled with:

</>

Copy

sudo ip link set dev eth0 down
sudo ip link set dev eth0 up

Device-disabling commands should be tested carefully because disabling a boot disk, active network interface, console device, or required controller can make a system inaccessible.

What is LVM in Linux?

Logical Volume Manager provides a flexible layer between physical storage devices and filesystems. Physical volumes are combined into volume groups, and logical volumes are allocated from those groups.

Physical volume: A disk or partition initialized for LVM.
Volume group: A storage pool made from one or more physical volumes.
Logical volume: A virtual block device allocated from a volume group.

</>

Copy

sudo pvs
sudo vgs
sudo lvs

Linux Package Management Interview Questions

How do you install packages on Debian-based Linux systems?

</>

Copy

sudo apt update
sudo apt install nginx
sudo apt remove nginx
apt list --installed

How do you install packages on Red Hat-based Linux systems?

</>

Copy

sudo dnf install nginx
sudo dnf remove nginx
dnf list installed

Older systems may use yum. Current package-management commands and repository configuration depend on the distribution and release.

What is the difference between a package manager and a package format?

A package format defines how software files and metadata are packaged, such as DEB or RPM. A package manager resolves dependencies, downloads packages from repositories, installs or removes software, and tracks package state. Examples include APT, DNF, and Zypper.

Linux Shell Scripting Interview Questions

What is a shebang in a shell script?

A shebang is the first line of an executable script and specifies the interpreter that should run it.

</>

Copy

#!/usr/bin/env bash

How do you pass arguments to a Bash script?

Positional parameters are accessed as $1, $2, and so on. $# gives the argument count, and "$@" expands to all arguments while preserving argument boundaries.

</>

Copy

#!/usr/bin/env bash

printf 'First argument: %s\n' "$1"
printf 'Argument count: %s\n' "$#"

for argument in "$@"; do
    printf '%s\n' "$argument"
done

What is the difference between single and double quotes in Bash?

Single quotes preserve characters literally and prevent variable and command expansion.
Double quotes allow variable and command substitution while preserving most whitespace and preventing unwanted word splitting.

</>

Copy

name="Alice"
echo '$name'
echo "$name"

Why should shell variables usually be quoted?

Quoting prevents unintended word splitting and wildcard expansion when a variable contains spaces, tabs, newlines, or glob characters.

</>

Copy

rm -- "$filename"
printf '%s\n' "$value"

Linux Interview Questions for DevOps and System Administrators

What is SSH and how is key-based authentication configured?

SSH provides encrypted remote login and command execution. Key-based authentication uses a private key on the client and a corresponding public key in the remote user’s ~/.ssh/authorized_keys file.

</>

Copy

ssh-keygen -t ed25519
ssh-copy-id user@example-host
ssh user@example-host

Private keys must be protected. Server-side SSH settings should be changed only after verifying that a working administrative access method remains available.

How do cron jobs work in Linux?

Cron runs commands according to time-based schedules. User crontabs are managed with crontab, while system jobs may also be defined under /etc/cron.d/ and related directories.

</>

Copy

crontab -e
crontab -l

</>

Copy

0 2 * * * /usr/local/bin/backup.sh

This schedule runs the script every day at 02:00 according to the cron service’s timezone. Scripts used by cron should use absolute paths, predictable environment settings, logging, and error handling.

What is the difference between cron and systemd timers?

Both schedule recurring work. Cron uses crontab syntax, while systemd timers integrate with service units, dependencies, journal logging, missed-run handling, and other systemd features. The appropriate choice depends on the system and operational requirements.

How do you check open files used by a process?

</>

Copy

sudo lsof -p 1234
ls -l /proc/1234/fd

What is a file descriptor?

A file descriptor is a process-local integer used to refer to an open file, pipe, socket, terminal, or other I/O resource. By convention, descriptor 0 is standard input, 1 is standard output, and 2 is standard error.

How do you inspect kernel messages?

</>

Copy

dmesg --level=err,warn
journalctl -k

Kernel logs are useful for diagnosing device failures, filesystem errors, out-of-memory events, driver problems, and boot issues. Access may require elevated privileges.

Scenario-Based Linux Troubleshooting Interview Questions

A Linux server is slow. How would you investigate it?

Confirm when the problem started, which services are affected, and whether a recent change occurred.
Check load average, CPU utilization, memory pressure, swap activity, and I/O wait.
Identify processes consuming CPU, memory, disk I/O, or excessive file descriptors.
Check filesystem capacity and inode availability.
Review service status, application logs, system logs, and kernel messages.
Inspect network errors, packet loss, DNS delays, and connection counts when the workload depends on network services.
Check for hardware, storage, or virtualization-layer warnings.
Apply one measured change at a time and verify the result with metrics.

</>

Copy

uptime
free -h
vmstat 1
top
df -h
df -i
journalctl -p err --since "1 hour ago"

A filesystem is full. What steps would you take?

Use df -h to identify the full filesystem.
Use df -i to check inode exhaustion.
Use du without crossing filesystem boundaries to locate large directories.
Check for large logs, caches, temporary files, old backups, core dumps, and application data.
Check for deleted files still held open by running processes.
Remove or archive data only after confirming ownership and retention requirements.
Correct log rotation, retention, application behavior, or capacity planning so the issue does not recur.

</>

Copy

df -h
df -i
sudo du -xhd1 /var | sort -h
sudo lsof +L1

A service fails to start. How would you troubleshoot it?

Inspect the service status and recent journal entries.
Validate the application’s configuration with its built-in test command when available.
Check file permissions, ownership, paths, environment files, and required directories.
Check whether another process already uses the required port.
Verify dependencies, mounted filesystems, certificates, secrets, and network access.
Review recent package or configuration changes.
Correct the underlying error and restart the service.

</>

Copy

systemctl status myservice
journalctl -u myservice -b
systemctl cat myservice
ss -tulpen

A process uses 100 percent CPU. What would you check?

Identify the process and confirm whether the usage is expected for the workload.
Check whether one thread or all threads are busy.
Review application logs and recent deployments.
Inspect system-call activity and stack traces with appropriate diagnostic tools when permitted.
Check whether the process is repeatedly retrying failed network, storage, or dependency operations.
Apply a safe mitigation such as traffic reduction, process restart, rollback, or resource adjustment after preserving required evidence.
Correct the application or configuration issue rather than relying only on repeated restarts.

A user can read a file but cannot modify it. What would you inspect?

File owner, group, and mode bits.
User UID and supplementary group memberships.
Access control lists.
Parent directory permissions.
Read-only filesystem mounts.
Immutable file attributes.
Security controls such as SELinux or AppArmor.
Application-specific locks or filesystem errors.

</>

Copy

ls -l file.txt
namei -l /path/to/file.txt
getfacl file.txt
lsattr file.txt
mount | grep ' /relevant/mount '

A hostname resolves incorrectly. How would you troubleshoot DNS?

Check the exact hostname, expected address, and affected system.
Query resolution through the operating-system resolver with getent.
Inspect configured DNS servers and local resolver state.
Query a specific DNS server with dig to compare results.
Check /etc/hosts, search domains, caching layers, and split-DNS behavior.
Review DNS record type, TTL, propagation, and whether the query is made from the correct network.

SSH access stopped working after a configuration change. What should you do?

Keep the existing administrative session open if one is still available.
Validate the SSH configuration before restarting or reloading the service.
Check service status, logs, listening ports, firewall rules, and network routes.
Verify account status, shell, home-directory ownership, and SSH key permissions.
Use console or out-of-band access when remote access is unavailable.
Roll back the incorrect configuration and test a second login before closing the working session.

</>

Copy

sudo sshd -t
systemctl status sshd
journalctl -u sshd
ss -tlnp | grep ':22'

Linux Interview Questions for Experienced Candidates

What happens when a Linux system boots?

A simplified boot sequence is:

Firmware performs hardware initialization and selects a boot device.
A bootloader loads the Linux kernel and initial RAM filesystem.
The kernel initializes memory, CPUs, device drivers, and essential subsystems.
The initial RAM filesystem provides temporary tools needed to locate and mount the real root filesystem.
The kernel starts the first user-space process, commonly systemd with process ID 1.
The init system starts services, mounts filesystems, configures devices and networking, and reaches the selected target.

What is a context switch?

A context switch occurs when the CPU stops executing one task and begins executing another. The kernel saves and restores execution state such as registers and scheduling information. Context switching is necessary for multitasking, but excessive switching can add overhead.

What is the difference between a process and a thread?

A process has its own virtual address space and resource context. Threads within a process share much of that process’s memory and resources while maintaining separate execution state such as stacks and CPU registers.

What is copy-on-write?

Copy-on-write allows processes or storage snapshots to share the same underlying data until one participant modifies it. A private copy is created only when a write occurs. This reduces unnecessary copying and is used in process creation, memory management, filesystems, and virtualization.

What is the OOM killer?

When the kernel cannot satisfy memory allocations and recovery is not possible, the out-of-memory killer may terminate one or more processes to recover memory. Kernel logs should be reviewed to confirm an OOM event and identify the selected process.

</>

Copy

journalctl -k | grep -i -E 'out of memory|killed process|oom'
dmesg | grep -i -E 'out of memory|killed process|oom'

What is SELinux?

SELinux is a mandatory access control system that applies security policy in addition to normal Unix permissions. It assigns security contexts to processes and resources and can operate in enforcing, permissive, or disabled modes.

Disabling SELinux should not be the default response to a denial. Review audit logs, verify file contexts and policy expectations, and apply the narrowest correct policy change.

</>

Copy

getenforce
ls -Z /var/www/html
sudo ausearch -m AVC -ts recent

What is AppArmor?

AppArmor is a mandatory access control system that restricts applications through path-based security profiles. Profiles can run in enforce or complain mode. It is commonly used on Ubuntu and SUSE-based systems.

What are Linux namespaces and control groups?

Namespaces: Isolate views of system resources such as process IDs, mount points, networks, hostnames, users, and interprocess communication.
Control groups: Organize processes and control or account for resource usage such as CPU, memory, and I/O.

Containers use namespaces for isolation and control groups for resource management, together with filesystems, capabilities, and security controls.

How would you make a Linux service more reliable?

Run it under a service manager with clear restart and dependency policies.
Use health checks and meaningful monitoring.
Set resource limits and file-descriptor limits according to measured needs.
Centralize logs and alert on actionable conditions.
Keep configuration in version control and validate it before deployment.
Use least-privilege service accounts and protect secrets.
Test backup, restoration, restart, upgrade, and rollback procedures.
Document known failure modes and operational runbooks.

Frequently Asked Linux Interview Questions

Which Linux commands should freshers prepare for interviews?

Freshers should understand ls, cd, pwd, cp, mv, rm, mkdir, cat, less, grep, find, sed, awk, chmod, chown, ps, kill, top, df, du, free, ip, ss, systemctl, and journalctl. They should also be able to explain common options rather than only memorizing command names.

What Linux topics are asked in DevOps interviews?

DevOps interviews commonly cover shell scripting, process and service management, SSH, permissions, logs, package management, networking, DNS, storage, cron or systemd timers, resource troubleshooting, containers, security controls, and automation. Candidates may also be asked to diagnose a failed deployment or unavailable service.

How should experienced candidates answer Linux scenario questions?

Start by clarifying the symptoms, affected systems, timing, and recent changes. Explain which metrics, logs, commands, and configuration files you would inspect. State how you would reduce risk, preserve evidence, apply a fix, verify recovery, and prevent recurrence.

Is Linux the same as Unix?

No. Linux is a Unix-like operating-system kernel and ecosystem. Unix refers to a family of operating systems with a different historical and certification background. Linux follows many Unix concepts and interfaces but is not the original Unix source code.

Should Linux interview answers include commands?

Commands are useful, but an answer should also explain what the command checks, what output matters, and what action follows. For troubleshooting questions, reasoning and safe operational procedure are usually more informative than a long list of commands.

Linux Interview Preparation and Editorial QA Checklist

Can you distinguish the Linux kernel, shell, distribution, and user-space utilities?
Can you explain Linux filesystem directories, inodes, links, mounts, disk blocks, and inode exhaustion?
Can you calculate symbolic and numeric file permissions and explain directory permissions?
Can you manage users, groups, passwords, sudo access, and account files safely?
Can you inspect processes, send signals, identify zombies, and explain load average?
Can you interpret memory usage, swap activity, CPU utilization, and I/O wait?
Can you manage systemd services and retrieve relevant journal logs?
Can you inspect interfaces, routes, ports, DNS resolution, and application connectivity?
Can you diagnose a full filesystem, failed service, high CPU process, DNS error, or SSH failure?
Can you explain SSH keys, cron schedules, shell quoting, redirection, pipes, and exit codes?
Can you explain SELinux or AppArmor without treating security controls as obstacles to disable?
Are every command, path, and option in the tutorial valid for the stated distribution context?
Do troubleshooting answers include validation, rollback, logging, and recurrence prevention?
Are potentially destructive commands accompanied by scope, permission, and safety considerations?