Interview Q&A / Linux & Shell
Linux & Shell interview questions
Permissions, processes, pipes and the commands you are expected to know cold.
Prefer rapid revision? Practise Linux & Shell short interview answers →
- How do you check disk space and memory usage on a Linux server?
Use df -h to see free space on each mounted file system, du -sh to see how much space a folder takes, and free -h to see RAM and swap. In free, look at the "available" column, not "free", because Linux uses spare RAM as disk cache and gives it back when programs need it.
IntermediateIn-depth3 min read - What is the difference between a hard link and a soft link in Linux?
A hard link is another name for the same file on disk (the same inode), so the data stays as long as any name exists. A soft (symbolic) link is a small separate file that stores a path to the target; it breaks if the target is moved or deleted, but it can point to directories and across file systems.
IntermediateIn-depth3 min read - How do you check whether a remote port is reachable from a Linux machine?
Use nc -zv host port for a quick TCP check, or curl -v telnet://host:port, or bash's /dev/tcp. A refused connection means nothing listens there; a timeout usually means a firewall or routing problem. ping only tests ICMP, not ports.
IntermediateQuick answer1 min read - How do you find which package a file or command belongs to?
On Debian and Ubuntu use dpkg -S /path/to/file for installed files and apt-file search for files not yet installed. On Red Hat family systems use rpm -qf /path for installed files and dnf provides '*/name' for uninstalled ones.
IntermediateQuick answer1 min read - How do you make systemd restart a service automatically if it crashes?
Set Restart=on-failure (or always) in the [Service] section, usually with RestartSec= to add a delay. systemd then restarts the process after a crash, and StartLimitBurst and StartLimitIntervalSec stop endless crash loops.
IntermediateQuick answer1 min read - How do you stop a package from being upgraded on Debian or Ubuntu?
Use sudo apt-mark hold package to freeze it at the current version and apt-mark unhold to release it. For finer control, such as preferring a specific version or repository, use APT pinning in /etc/apt/preferences.d/.
IntermediateQuick answer1 min read - How do you write a simple systemd service file for your own app?
Create a .service file in /etc/systemd/system with a [Unit] description, a [Service] section giving ExecStart and a user, and an [Install] section with WantedBy=multi-user.target. Then run systemctl daemon-reload and systemctl enable --now name.
IntermediateQuick answer1 min read - What are nice and renice, and what do the values mean?
nice starts a process with a chosen priority adjustment and renice changes it for a running process. Niceness ranges from -20 (highest priority) to 19 (lowest). Lowering priority with a higher number is polite to others; raising it needs root.
IntermediateQuick answer1 min read - What are systemd targets, and how do they relate to old runlevels?
A target is a group of units that represents a system state, such as multi-user.target (text mode, networking) or graphical.target (with a desktop). They replace SysV runlevels: runlevel 3 is multi-user.target and 5 is graphical.target. Check or change with systemctl get-default and set-default.
IntermediateQuick answer1 min read - What do the curl flags -s, -L, -o, -f and -I do?
-s hides the progress meter, -L follows redirects, -o saves the body to a file, -f makes curl fail with a non-zero exit code on HTTP errors, and -I fetches only the headers. A common combination in scripts is curl -fsSL.
IntermediateQuick answer1 min read - What does load average mean in top and uptime?
Load average is the average number of processes running or waiting for the CPU (and, on Linux, waiting on uninterruptible I/O) over the last 1, 5 and 15 minutes. Compare it with the number of CPU cores: on 4 cores, a load near 4 means fully busy.
IntermediateQuick answer1 min read - What does SGID do on a directory, and when is it useful?
On a directory, SGID makes new files and sub-folders inherit the directory's group instead of the creator's primary group. It is used for shared team folders so everyone's files stay accessible to the same group. It shows as s in the group execute slot.
IntermediateQuick answer1 min read - What does the execute permission mean on a directory?
On a directory, execute (x) means permission to enter it and access items by name. Read (r) lets you list names, and write (w) lets you create or delete entries. Without x on a directory you cannot cd into it or open files inside, even if the files themselves are readable.
IntermediateQuick answer1 min read - What extra information does stat show compared to ls -l?
stat prints a file's full metadata: exact size, blocks, inode number, link count, permissions in octal and symbolic form, owner, and three timestamps (access, modify, change). ls -l shows only a short summary.
IntermediateQuick answer1 min read - What is /proc in Linux, and is it a real folder on disk?
/proc is a virtual file system created by the kernel in memory. Its files show live information about running processes and the system, such as /proc/cpuinfo and /proc/PID/status. Nothing in it is stored on disk.
IntermediateQuick answer1 min read - What is a package repository, and why do package managers check GPG signatures?
A repository is a server holding packages and an index that package managers read. Packages and indexes are signed with GPG keys so your system can verify they came from the publisher and were not altered. Adding a third-party repository means trusting its key.
IntermediateQuick answer1 min read - What is a zombie process, and how do you get rid of it?
A zombie is a process that has finished but still has an entry in the process table because its parent has not read its exit status. It uses no CPU or memory beyond that entry. You fix it by making the parent call wait, restarting the parent, or killing the parent so init adopts and cleans it.
IntermediateQuick answer1 min read - What is the difference between cp -r and cp -a?
cp -r copies directories recursively but new files get fresh timestamps, your ownership and default permissions. cp -a (archive) also preserves permissions, ownership, timestamps and symlinks, so the copy matches the original as closely as possible.
IntermediateQuick answer1 min read - What is the difference between scp and rsync for copying files over SSH?
Both copy over SSH. scp sends the whole file every time, while rsync compares source and destination and sends only the differences, can resume, and can preserve permissions and delete extras. Use scp for one-off copies and rsync for repeated syncs and large folders.
IntermediateQuick answer1 min read - What is the sticky bit, and why does /tmp have it?
The sticky bit on a directory means only a file's owner, the directory's owner or root may delete or rename files inside, even if others have write permission on the directory. It shows as a t at the end of the permissions, for example drwxrwxrwt.
IntermediateQuick answer1 min read - What is the SUID bit, and how can passwd change root-owned files?
SUID makes an executable run with the permissions of its file owner instead of the user who launched it. passwd is owned by root with SUID set, so a normal user can update /etc/shadow through it. The bit shows as s in the owner execute slot.
IntermediateQuick answer1 min read - What is umask, and how does it decide default file permissions?
umask is a mask of permission bits that are removed from the defaults for newly created files and directories. Files start from 666 and directories from 777, so a umask of 022 gives files 644 and directories 755.
IntermediateQuick answer1 min read - When do you need grep -E, and what is the difference from basic grep patterns?
Basic grep treats +, ?, | and () as ordinary characters unless escaped. grep -E (extended regex) gives them their regex meaning, so grep -E 'cat|dog' matches either word. Use -F when you want a plain fixed string with no regex at all.
IntermediateQuick answer1 min read - When would you use cut instead of awk?
cut extracts fixed fields by a single-character delimiter or character positions and is simple and fast. awk handles runs of spaces, conditions and calculations. Use cut for neat CSV-like data and awk for messy whitespace-aligned output.
IntermediateQuick answer1 min read