Linux Interview Questions

A curated set of Linux interview questions, ordered roughly from fundamentals to more practical, day-to-day scenarios — the kind you'll actually be asked in real screens and on-sites.

Filesystem and permissions#

Q: What do the permission bits in rwxr-xr-x mean? Reading left to right in groups of three: the owner has read, write, and execute (rwx); the group has read and execute (r-x); and everyone else has read and execute (r-x). As a number, that's 755 — owner 7 (4+2+1), group 5 (4+0+1), other 5 (4+0+1). On a directory, the execute bit specifically controls whether you can cd into it or access files inside by path, separately from whether you can list its contents with ls.

Q: What's the difference between a hard link and a symbolic link? A hard link is a second directory entry pointing at the same underlying data (inode) as the original file — both names are equally "real," the data persists as long as any hard link exists, and hard links can't cross filesystems or point at directories. A symbolic link is a small separate file that stores a path to another file, similar to a shortcut — it can cross filesystems and point at directories, but breaks ("dangling") if the target is moved or deleted.

Commands and shell usage#

Q: What's the difference between piping and redirection? A pipe (|) connects one command's standard output directly to the next command's standard input, letting you chain small tools into a larger pipeline (e.g., cat access.log | grep 500 | wc -l). Redirection (>, >>, 2>) sends output to a file instead: > overwrites the file's contents, >> appends to the end of it, and 2> redirects standard error specifically rather than standard output.

Q: How would you find out which process is using a specific network port? sudo lsof -i :8080 or sudo ss -tulpn | grep :8080 both list the process bound to that port along with its PID, which you can then inspect further or terminate. This comes up constantly when a service fails to start with an "address already in use" error and you need to find what's already holding the port.

Q: What's the difference between kill and kill -9? Plain kill sends the SIGTERM signal — a polite request that the process can intercept to shut down gracefully, closing files and connections first. kill -9 sends SIGKILL, which the kernel enforces immediately and unconditionally, giving the process no chance to clean up. SIGKILL should be a last resort for processes that are genuinely unresponsive to SIGTERM.

Processes and signals#

Q: What is a process signal, conceptually? A signal is an asynchronous notification sent to a process by the kernel, another process, or a user, telling it that something happened — it may need to terminate, reload its configuration, or handle an interrupt. Common examples include SIGTERM (please terminate), SIGKILL (terminate immediately, uncatchable), SIGHUP (often used to mean "reload config"), and SIGINT (sent by Ctrl+C in a terminal).

Q: Given a runaway process consuming high CPU, how would you investigate and stop it? Start with top or ps aux --sort=-%cpu to identify the offending PID and confirm it's actually the right process before acting. Send it a normal kill <pid> (SIGTERM) first to give it a chance to shut down cleanly, and only escalate to kill -9 <pid> if it fails to respond after a reasonable wait — killing the wrong PID or jumping straight to -9 risks losing in-flight work or leaving resources in an inconsistent state.

Services and systemd#

Q: What's the difference between systemctl start and systemctl enable? systemctl start runs the service immediately, but has no effect on whether it starts again after a reboot. systemctl enable links the unit into the boot targets so it starts automatically on every future boot, but doesn't affect whether it's running right now. They're independent — a service can be started but not enabled (won't survive a reboot), or enabled but not started (won't be running until the next boot), which is why systemctl enable --now is the common shortcut for "start it and make sure it comes back after a restart."

Networking and security#

Q: How would you check what's using CPU, memory, or disk on a slow server, and does a low "free memory" number always mean a real problem? top/htop shows live CPU and memory per process, sortable by either; df -h shows filesystem-level disk usage, and du -h --max-depth=1 narrows down which directory is responsible for it. A low "free" memory figure is often not actually a problem: Linux uses otherwise-idle memory for disk caching (shown as buff/cache), which the kernel reclaims instantly on demand — the number to actually worry about is available memory combined with swap usage, not the raw "free" column alone.

Q: What are the first few things you'd do to secure a brand-new internet-facing Linux server? Set up SSH key-based authentication and confirm it works, then disable password authentication (PasswordAuthentication no) and root login (PermitRootLogin no) in sshd_config — always testing in a second, still-open session before closing the first, to avoid a lockout. On top of that, a firewall (ufw, allowing only the ports genuinely needed) and fail2ban (automatically banning source addresses after repeated failed login attempts) cover the two remaining common attack surfaces: unnecessary open ports, and brute-force scanning against whatever's left open.