Linux Interview Questions and Answers

This page covers Linux interview questions ranging from basic command-line usage to advanced system administration and troubleshooting scenarios commonly asked in SysAdmin, DevOps, and SRE interviews.

Basic Linux Interview Questions

What is Linux?
Linux is an open-source, Unix-like operating system kernel originally developed by Linus Torvalds.

It forms the core of many operating systems used in servers, cloud platforms, embedded systems, and desktops. Linux is popular due to its stability, security, flexibility, and strong community support, making it the foundation of most modern cloud and DevOps environments.
What is the root user?
The root user is the superuser account with unrestricted access to all system resources.

Root can modify system files, manage users, and install or remove software. For security reasons, best practice is to avoid direct root logins and use sudo to perform administrative tasks with proper auditing.
Explain Linux file permissions.
Linux file permissions control who can read, write, or execute a file.

Permissions are defined for three categories: owner, group, and others, using read (r), write (w), and execute (x) flags. Proper permission management is critical for system security and preventing unauthorized access.
What does the chmod command do?
The chmod command is used to change file or directory permissions.

Permissions can be set using numeric or symbolic notation. For example, chmod 755 script.sh grants full access to the owner and read/execute access to others, which is common for executable scripts.
What is a process?
A process is a running instance of a program with its own process ID (PID), memory space, and execution context.

Linux provides tools such as ps, top, and htop to monitor and manage processes. Understanding processes is essential for performance tuning and troubleshooting.
Difference between a process and a thread?
A process has its own memory space, while threads share memory within a process.

Threads are lighter and faster to create, but issues in one thread can affect others. Modern applications often use multithreading for better performance.
What is the Linux filesystem hierarchy?
The Linux filesystem follows a standard directory structure.

Key directories include / (root), /etc (configuration), /var (logs and variable data), /home (user files), and /bin//usr/bin (executables).
What is a shell in Linux?
A shell is a command-line interpreter that allows users to interact with the system.

Popular shells include Bash, Zsh, and Fish. The shell executes commands, scripts, and automates tasks, making it a core tool for system administrators.
What is Bash?
Bash (Bourne Again Shell) is the default shell on most Linux distributions.

It supports scripting, job control, command history, and environment variables, making it essential for automation and DevOps workflows.
What is a Linux package manager?
A package manager installs, updates, and removes software packages.

Examples include apt (Debian/Ubuntu), yum/dnf (RHEL-based systems). Package managers handle dependencies and simplify software management.
What is sudo and why is it used?
The sudo command allows permitted users to execute commands as root.

It improves security by limiting root access, logging administrative actions, and enforcing least privilege access in multi-user systems.
What is a Linux service?
A service is a background process that runs continuously.

Services such as web servers, databases, and cron jobs are managed using systemd commands like systemctl start, stop, and status.
What is systemd?
systemd is the init system responsible for starting and managing services.

It improves boot speed, handles service dependencies, and provides centralized logging through journalctl, making system management more reliable.
What is a Linux log file?
Log files record system and application events.

They are primarily stored in /var/log and are critical for debugging, security audits, and performance analysis.
What does the df command do?
The df command displays disk space usage for mounted filesystems.

It helps administrators detect low disk space conditions that can cause application failures or system instability.
What does the du command do?
The du command estimates file and directory disk usage.

It is commonly used with sorting options to identify large directories consuming excessive storage.
What is a soft link (symbolic link)?
A soft link is a reference to a file path.

It can cross filesystems and breaks if the target file is deleted or moved, making it flexible but less durable than hard links.
What is a hard link?
A hard link points directly to the file’s inode.

It remains valid even if the original filename is deleted, but it cannot span filesystems or reference directories.
What is a Linux environment variable?
Environment variables store configuration values for processes.

They are commonly used to define paths, credentials, and runtime settings. Variables can be set temporarily or permanently via shell configuration files.
Why is Linux widely used in servers and cloud platforms?
Linux is stable, secure, and highly customizable.

Its open-source nature, strong networking stack, and efficient resource usage make it ideal for running scalable, always-on server workloads in cloud and data center environments.

Advanced & Scenario-Based Linux Interview Questions

A Linux server is running out of disk space. How do you troubleshoot it?
Running out of disk space can cause application failures, log loss, and system instability.

Start by checking filesystem usage using df -h to identify affected partitions. Then locate large directories with du -sh /* | sort -h. Common causes include unrotated logs, Docker images, temporary files, or backups. After cleanup, configure log rotation and monitoring to prevent recurrence.
A service is running, but users cannot access it. What do you check?
This usually indicates a networking, firewall, or permission issue rather than a service failure.

Verify the service is listening on the correct interface and port using ss -tuln. Check firewall rules via iptables or firewalld, and confirm SELinux mode using getenforce. Logs often reveal denied connections or permission issues.
Explain systemd and why it is important in modern Linux systems.
systemd is the init system responsible for bootstrapping the OS and managing services.

It provides dependency-based startup, parallel service initialization, and better process supervision. Centralized logging via journalctl simplifies debugging boot failures, crashes, and service restarts in production systems.
How do you identify processes consuming high CPU or memory?
High resource usage often leads to performance degradation or outages.

Use top or htop for real-time monitoring and ps aux --sort=-%cpu or --sort=-%mem for snapshot analysis. Investigate whether usage is expected, caused by load, memory leaks, or runaway processes before taking action.
What happens during the Linux boot process?
The boot process starts with BIOS/UEFI initialization, followed by the bootloader.

The kernel is loaded into memory, initializes hardware, and hands control to systemd. systemd then starts services based on dependencies. Understanding this sequence is critical when diagnosing boot failures or slow startup issues.
A Linux server becomes unreachable after a reboot. How do you troubleshoot?
Post-reboot failures are often related to network configuration or filesystem issues.

Check boot logs using journalctl -xb, verify network interfaces with ip a, and confirm services are running. If remote access fails, console access is essential to identify misconfigurations introduced during the last change.
How do you troubleshoot high load average on a Linux system?
High load indicates many processes competing for CPU or I/O.

Use uptime to confirm load, top to identify blocked processes, and iostat or vmstat to check I/O wait. Determine whether CPU, disk, or memory pressure is the real bottleneck.
What is the difference between load average and CPU usage?
CPU usage measures how busy the CPU is at a given time.

Load average represents the number of processes waiting for CPU or I/O. A system can have low CPU usage but high load due to disk or network bottlenecks, which is a common interview trick question.
A process was killed unexpectedly. How do you investigate?
Unexpected process termination often results from out-of-memory conditions.

Check system logs for OOM killer messages using dmesg or journalctl. Review memory usage trends and enforce memory limits or optimize the application to prevent future crashes.
How do you analyze disk I/O performance issues?
Disk I/O bottlenecks cause slow application responses and timeouts.

Use iostat, iotop, and vmstat to identify heavy disk usage. Investigate whether the issue is caused by logging, database activity, or hardware limitations.
What is SELinux and why does it cause issues?
SELinux enforces mandatory access control policies on processes.

Applications may fail if policies block required actions. Instead of disabling SELinux, review audit logs using ausearch and apply appropriate policy adjustments for long-term security.
How do you safely restart a critical service in production?
Restarting services can impact users if not planned properly.

Check service dependencies, active connections, and maintenance windows. Use graceful restart options when available and monitor logs closely to ensure the service comes back cleanly.
A server is slow but CPU and memory look normal. What else do you check?
Slowness without resource saturation often points to I/O or network issues.

Check disk latency, network packet drops, DNS resolution delays, and external dependencies. Application-level bottlenecks are often hidden behind normal system metrics.
How do you troubleshoot cron jobs that are not running?
Cron failures are usually silent and overlooked.

Verify cron service status, job syntax, execution permissions, and environment variables. Check cron logs and redirect output to logs for easier debugging.
What is the difference between soft and hard links?
Hard links reference the same inode as the original file.

Soft links reference the file path and break if the target is deleted. Understanding this difference is important for file recovery and backups.
How do you detect zombie processes?
Zombie processes appear when a parent does not collect child exit status.

Use ps aux | grep Z to identify zombies. They do not consume resources but indicate poor process handling that should be fixed at the application level.
What happens when disk inode usage is exhausted?
Files cannot be created even if disk space is available.

This commonly occurs on systems with many small files. Use df -i to diagnose and clean unnecessary files or adjust filesystem design.
How do you debug network connectivity issues on Linux?
Network issues are a frequent cause of outages.

Use ping, traceroute, ss, and tcpdump to isolate failures at different layers. Always verify DNS resolution, routing tables, and firewall rules.
How do you investigate a memory leak?
Memory leaks cause gradual performance degradation.

Monitor memory usage over time, analyze process behavior, and use profiling tools or language-specific debuggers. Long-running processes should be restarted or fixed permanently.
Why is log rotation important in Linux systems?
Unmanaged logs can quickly fill disk space and cause outages.

Log rotation ensures logs are archived, compressed, and removed automatically. Proper configuration prevents disk exhaustion and simplifies troubleshooting by keeping logs manageable.

These advanced questions are frequently asked in Linux Administrator, DevOps Engineer, and Cloud Engineer interviews.