Interview Q&A / Linux & Shell
Linux & Shell interview questions
Permissions, processes, pipes and the commands you are expected to know cold.
Prefer rapid revision? Practise Linux & Shell short interview answers →
- How do Ctrl+Z, bg, fg and jobs work in a shell?
Ctrl+Z suspends the foreground job, bg resumes it in the background, fg brings it back to the foreground and jobs lists the shell's jobs with numbers. Appending & to a command starts it in the background directly.
BeginnerQuick answer1 min read - How do you change a file's owner and group with chown?
Use chown user file to change the owner and chown user:group file to change both. Add -R to apply it to a whole directory tree. Only root can give files away to another user; chgrp changes just the group.
BeginnerQuick answer1 min read - How do you count how often each line appears, sorted from most to least?
Sort the input, count duplicates with uniq -c, then sort numerically in reverse: sort file | uniq -c | sort -nr. uniq only compares adjacent lines, so the first sort is required. Add head to keep the top results.
BeginnerQuick answer1 min read - How do you find or stop processes by name using pgrep and pkill?
pgrep prints the PIDs of processes whose names match a pattern, and pkill sends them a signal (SIGTERM by default). Use -f to match the full command line and -u to limit to a user. Always run pgrep first to see what would be hit.
BeginnerQuick answer1 min read - How do you print specific columns of a command's output with awk?
awk splits each line into fields on whitespace and gives them as $1, $2 and so on, with $NF as the last and $0 as the whole line. awk '{print $1, $3}' prints columns 1 and 3. Use -F to set another separator, such as -F: for /etc/passwd.
BeginnerQuick answer1 min read - How do you read the output of systemctl status?
The header shows Loaded (unit file path and whether it is enabled) and Active (running, inactive or failed, with how long). Below come the main PID, memory and CPU use, the process tree and the last log lines, which usually reveal why a service failed.
BeginnerQuick answer1 min read - How do you replace text in a file using sed?
sed 's/old/new/' replaces the first match on each line; add g to replace every match on a line. Add -i to edit the file in place, ideally with a backup suffix like -i.bak, otherwise sed only prints the changed text.
BeginnerQuick answer1 min read - How do you see which ports are listening and which process owns them?
Run sudo ss -tulpn. It lists TCP and UDP listening sockets with numeric ports and the owning process name and PID. ss has replaced the older netstat on modern Linux, and you can filter with grep or an expression like sport = :8080.
BeginnerQuick answer1 min read - How do you send GET and POST requests with curl?
curl URL sends a GET. For a POST with JSON use curl -X POST -H 'Content-Type: application/json' -d '{...}' URL. Adding -d already makes the request a POST, and -i or -v shows the response headers.
BeginnerQuick answer1 min read - How do you watch a log file grow in real time?
Use tail -f file to print the last lines and keep following new lines as they are written. tail -F also survives log rotation by reopening the file when it is replaced, and Ctrl+C stops it.
BeginnerQuick answer1 min read - How does SSH key-based login work, and how do you set it up?
You generate a key pair with ssh-keygen, keep the private key on your machine and copy the public key to the server's ~/.ssh/authorized_keys with ssh-copy-id. The server then challenges you to prove you hold the private key, so no password crosses the network.
BeginnerQuick answer1 min read - How does the mv command work for both renaming and moving files?
mv changes a file's name or location. Within the same file system it only updates the directory entry, so it is instant even for huge files; across file systems it copies the data and then deletes the original.
BeginnerQuick answer1 min read - What are /dev/null and /dev/zero, and what are they used for?
/dev/null is a black hole: anything written to it vanishes and reading from it returns nothing. /dev/zero produces an endless stream of zero bytes. They are used to discard output and to create blank files of a given size.
BeginnerQuick answer1 min read - What do the grep options -i, -v, -c, -n and -w do?
-i ignores case, -v inverts the match to show non-matching lines, -c prints only a count of matching lines, -n adds line numbers and -w matches whole words only. They combine, so grep -ivn error file works.
BeginnerQuick answer1 min read - What does rm -rf do, and how do you avoid deleting the wrong thing?
rm -rf removes files and directories recursively and without prompting, and there is no recycle bin. Avoid accidents by checking with ls first, quoting variables, never running it as root casually, and using rm -i or trash tools where possible.
BeginnerQuick answer1 min read - What does the touch command do besides creating empty files?
touch updates a file's access and modification timestamps to now, and creates the file if it does not exist. You can also set a specific time with -t or -d, or copy another file's time with -r.
BeginnerQuick answer1 min read - What does the wc command count, and how do you use its options?
wc counts lines, words and bytes in a file or input. wc -l counts lines, -w words, -c bytes and -m characters. It is most often used at the end of a pipeline, such as grep error log | wc -l, to count matches.
BeginnerQuick answer1 min read - What is stored in /var, and why does it keep growing?
/var holds variable data that changes while the system runs: logs, mail spools, package caches, databases and print queues. It grows because logs and caches accumulate, which is why a full /var is a common cause of a server misbehaving.
BeginnerQuick answer1 min read - What is the difference between / and /root in Linux?
/ is the root of the whole file system tree, the parent of every other directory. /root is simply the home directory of the user named root, the administrator account. The two are unrelated except by name.
BeginnerQuick answer1 min read - What is the difference between /bin, /usr/bin and /sbin?
/bin and /usr/bin hold commands every user can run; /sbin and /usr/sbin hold system administration tools such as fdisk or iptables. On modern distributions /bin is a symlink to /usr/bin, so the old split between them no longer exists in practice.
BeginnerQuick answer1 min read - What is the difference between /tmp and /var/tmp?
Both are for temporary files. /tmp is meant for short-lived data and is often cleared at reboot (or is even held in RAM), while /var/tmp is for temporary files that should survive a reboot.
BeginnerQuick answer1 min read - What is the difference between apt and apt-get?
apt is the newer, friendlier front-end for interactive use, with a progress bar and combined commands such as apt install and apt list. apt-get is the older, stable interface with predictable output, so it is preferred in scripts.
BeginnerQuick answer1 min read - What is the difference between apt remove, purge and autoremove?
remove deletes a package's programs but keeps its configuration files. purge deletes the programs and the configs. autoremove deletes dependency packages that were installed automatically and are no longer needed by anything.
BeginnerQuick answer1 min read - What is the difference between apt update and apt upgrade?
apt update refreshes the local list of available packages and versions from the repositories but installs nothing. apt upgrade then installs newer versions of the packages you already have. Run update first, otherwise upgrade works from stale information.
BeginnerQuick answer1 min read - What is the difference between dpkg or rpm and apt or dnf?
dpkg (Debian) and rpm (Red Hat) install, remove and inspect single package files, but do not fetch dependencies. apt and dnf sit on top: they download from repositories and resolve dependencies automatically, calling dpkg or rpm to do the actual installation.
BeginnerQuick answer1 min read - What is the difference between ps aux and ps -ef?
Both list every process on the system. ps aux uses BSD-style options and shows %CPU, %MEM and memory sizes; ps -ef uses the POSIX style and shows the parent PID (PPID) and full start time. Choose aux for resource use and -ef for process relationships.
BeginnerQuick answer1 min read - What is the difference between running a command with & and with nohup?
& only puts the command in the background of the current shell; it can still die when the terminal closes. nohup makes the command ignore the hangup signal, so it keeps running after logout, and sends its output to nohup.out unless redirected.
BeginnerQuick answer1 min read - What is the difference between symbolic and octal modes in chmod?
Octal mode sets all permissions at once with numbers such as 640. Symbolic mode edits specific bits with letters, such as u+x or go-w, leaving the rest unchanged. Symbolic is safer for small tweaks; octal is better for setting a known final state.
BeginnerQuick answer1 min read - What is the difference between systemctl start and systemctl enable?
start runs a service right now, while enable makes it start automatically at boot. They are independent: a service can be running but disabled, or enabled but stopped. systemctl enable --now does both in one command.
BeginnerQuick answer1 min read - What is the purpose of the /etc directory in Linux?
/etc holds system-wide configuration files, mostly plain text, such as user accounts, network settings, service configs and the package manager's source lists. Programs read them at start-up, so editing a file here changes how the system behaves.
BeginnerQuick answer1 min read