Interview Q&A / Linux & Shell
Linux & Shell interview questions
Permissions, processes, pipes and the commands you are expected to know cold.
Prefer rapid revision? Practise Linux & Shell short interview answers →
- What is the difference between apt remove, purge and autoremove?
remove deletes a package's programs but keeps its configuration files. purge deletes the programs and the configs. autoremove deletes dependency packages that were installed automatically and are no longer needed by anything.
BeginnerQuick answer1 min read - What is the difference between apt update and apt upgrade?
apt update refreshes the local list of available packages and versions from the repositories but installs nothing. apt upgrade then installs newer versions of the packages you already have. Run update first, otherwise upgrade works from stale information.
BeginnerQuick answer1 min read - What is the difference between dpkg or rpm and apt or dnf?
dpkg (Debian) and rpm (Red Hat) install, remove and inspect single package files, but do not fetch dependencies. apt and dnf sit on top: they download from repositories and resolve dependencies automatically, calling dpkg or rpm to do the actual installation.
BeginnerQuick answer1 min read - What is the difference between ps aux and ps -ef?
Both list every process on the system. ps aux uses BSD-style options and shows %CPU, %MEM and memory sizes; ps -ef uses the POSIX style and shows the parent PID (PPID) and full start time. Choose aux for resource use and -ef for process relationships.
BeginnerQuick answer1 min read - What is the difference between running a command with & and with nohup?
& only puts the command in the background of the current shell; it can still die when the terminal closes. nohup makes the command ignore the hangup signal, so it keeps running after logout, and sends its output to nohup.out unless redirected.
BeginnerQuick answer1 min read - What is the difference between symbolic and octal modes in chmod?
Octal mode sets all permissions at once with numbers such as 640. Symbolic mode edits specific bits with letters, such as u+x or go-w, leaving the rest unchanged. Symbolic is safer for small tweaks; octal is better for setting a known final state.
BeginnerQuick answer1 min read - What is the difference between systemctl start and systemctl enable?
start runs a service right now, while enable makes it start automatically at boot. They are independent: a service can be running but disabled, or enabled but stopped. systemctl enable --now does both in one command.
BeginnerQuick answer1 min read - What is the purpose of the /etc directory in Linux?
/etc holds system-wide configuration files, mostly plain text, such as user accounts, network settings, service configs and the package manager's source lists. Programs read them at start-up, so editing a file here changes how the system behaves.
BeginnerQuick answer1 min read - When should you use less instead of cat?
cat dumps the whole file to the terminal at once, which suits short files and pipelines. less opens a scrollable pager that loads lazily, lets you search with / and quit with q, so it is the right tool for large files.
BeginnerQuick answer1 min read - How do you check whether a remote port is reachable from a Linux machine?
Use nc -zv host port for a quick TCP check, or curl -v telnet://host:port, or bash's /dev/tcp. A refused connection means nothing listens there; a timeout usually means a firewall or routing problem. ping only tests ICMP, not ports.
IntermediateQuick answer1 min read - How do you find which package a file or command belongs to?
On Debian and Ubuntu use dpkg -S /path/to/file for installed files and apt-file search for files not yet installed. On Red Hat family systems use rpm -qf /path for installed files and dnf provides '*/name' for uninstalled ones.
IntermediateQuick answer1 min read - How do you make systemd restart a service automatically if it crashes?
Set Restart=on-failure (or always) in the [Service] section, usually with RestartSec= to add a delay. systemd then restarts the process after a crash, and StartLimitBurst and StartLimitIntervalSec stop endless crash loops.
IntermediateQuick answer1 min read - How do you stop a package from being upgraded on Debian or Ubuntu?
Use sudo apt-mark hold package to freeze it at the current version and apt-mark unhold to release it. For finer control, such as preferring a specific version or repository, use APT pinning in /etc/apt/preferences.d/.
IntermediateQuick answer1 min read - How do you write a simple systemd service file for your own app?
Create a .service file in /etc/systemd/system with a [Unit] description, a [Service] section giving ExecStart and a user, and an [Install] section with WantedBy=multi-user.target. Then run systemctl daemon-reload and systemctl enable --now name.
IntermediateQuick answer1 min read - What are nice and renice, and what do the values mean?
nice starts a process with a chosen priority adjustment and renice changes it for a running process. Niceness ranges from -20 (highest priority) to 19 (lowest). Lowering priority with a higher number is polite to others; raising it needs root.
IntermediateQuick answer1 min read - What are systemd targets, and how do they relate to old runlevels?
A target is a group of units that represents a system state, such as multi-user.target (text mode, networking) or graphical.target (with a desktop). They replace SysV runlevels: runlevel 3 is multi-user.target and 5 is graphical.target. Check or change with systemctl get-default and set-default.
IntermediateQuick answer1 min read - What do the curl flags -s, -L, -o, -f and -I do?
-s hides the progress meter, -L follows redirects, -o saves the body to a file, -f makes curl fail with a non-zero exit code on HTTP errors, and -I fetches only the headers. A common combination in scripts is curl -fsSL.
IntermediateQuick answer1 min read - What does load average mean in top and uptime?
Load average is the average number of processes running or waiting for the CPU (and, on Linux, waiting on uninterruptible I/O) over the last 1, 5 and 15 minutes. Compare it with the number of CPU cores: on 4 cores, a load near 4 means fully busy.
IntermediateQuick answer1 min read - What does SGID do on a directory, and when is it useful?
On a directory, SGID makes new files and sub-folders inherit the directory's group instead of the creator's primary group. It is used for shared team folders so everyone's files stay accessible to the same group. It shows as s in the group execute slot.
IntermediateQuick answer1 min read - What does the execute permission mean on a directory?
On a directory, execute (x) means permission to enter it and access items by name. Read (r) lets you list names, and write (w) lets you create or delete entries. Without x on a directory you cannot cd into it or open files inside, even if the files themselves are readable.
IntermediateQuick answer1 min read - What extra information does stat show compared to ls -l?
stat prints a file's full metadata: exact size, blocks, inode number, link count, permissions in octal and symbolic form, owner, and three timestamps (access, modify, change). ls -l shows only a short summary.
IntermediateQuick answer1 min read - What is /proc in Linux, and is it a real folder on disk?
/proc is a virtual file system created by the kernel in memory. Its files show live information about running processes and the system, such as /proc/cpuinfo and /proc/PID/status. Nothing in it is stored on disk.
IntermediateQuick answer1 min read - What is a package repository, and why do package managers check GPG signatures?
A repository is a server holding packages and an index that package managers read. Packages and indexes are signed with GPG keys so your system can verify they came from the publisher and were not altered. Adding a third-party repository means trusting its key.
IntermediateQuick answer1 min read - What is a zombie process, and how do you get rid of it?
A zombie is a process that has finished but still has an entry in the process table because its parent has not read its exit status. It uses no CPU or memory beyond that entry. You fix it by making the parent call wait, restarting the parent, or killing the parent so init adopts and cleans it.
IntermediateQuick answer1 min read - What is the difference between cp -r and cp -a?
cp -r copies directories recursively but new files get fresh timestamps, your ownership and default permissions. cp -a (archive) also preserves permissions, ownership, timestamps and symlinks, so the copy matches the original as closely as possible.
IntermediateQuick answer1 min read - What is the difference between scp and rsync for copying files over SSH?
Both copy over SSH. scp sends the whole file every time, while rsync compares source and destination and sends only the differences, can resume, and can preserve permissions and delete extras. Use scp for one-off copies and rsync for repeated syncs and large folders.
IntermediateQuick answer1 min read - What is the sticky bit, and why does /tmp have it?
The sticky bit on a directory means only a file's owner, the directory's owner or root may delete or rename files inside, even if others have write permission on the directory. It shows as a t at the end of the permissions, for example drwxrwxrwt.
IntermediateQuick answer1 min read - What is the SUID bit, and how can passwd change root-owned files?
SUID makes an executable run with the permissions of its file owner instead of the user who launched it. passwd is owned by root with SUID set, so a normal user can update /etc/shadow through it. The bit shows as s in the owner execute slot.
IntermediateQuick answer1 min read - What is umask, and how does it decide default file permissions?
umask is a mask of permission bits that are removed from the defaults for newly created files and directories. Files start from 666 and directories from 777, so a umask of 022 gives files 644 and directories 755.
IntermediateQuick answer1 min read - When do you need grep -E, and what is the difference from basic grep patterns?
Basic grep treats +, ?, | and () as ordinary characters unless escaped. grep -E (extended regex) gives them their regex meaning, so grep -E 'cat|dog' matches either word. Use -F when you want a plain fixed string with no regex at all.
IntermediateQuick answer1 min read