Linux is an incredibly powerful and widely-used operating system, and it’s no surprise that Linux expertise is highly valued in the tech industry. If you’re looking to pursue a career in Linux, or simply want to improve your Linux skills, it’s important to understand the key concepts and technologies that underpin the operating system.
In this article, we’ve compiled a comprehensive list of Linux interview questions that cover a wide range of topics. Whether you’re a beginner or an experienced Linux user, this list will help you prepare for your next Linux interview and ensure you have a solid understanding of the most important Linux concepts.
From basic questions about file systems and permissions to advanced topics like process management and network configuration, these questions will test your knowledge and help you identify areas for further study.
Updated for 2026: This guide now includes scenario-based questions, modern
systemd/journaldcoverage,nftables, LVM, and thess/iptools that replace deprecated utilities, reflecting what employers actually ask in current sysadmin and DevOps interviews.
Watch
- 0:00 No two Linux interviews ask the same questions
- 1:11 1. Identify the system
- 3:31 2. Addresses and routes
- 5:44 3. Disk space
- 8:04 4. Mounts and filesystems
- 10:22 5. Services
- 12:44 6. Listening sockets
- 15:18 7. Processes and CPU
- 18:08 8. Memory
- 20:50 9. Permissions
- 23:23 10. Finding the answer
- 26:08 All ten, and what to do with them
The video makes the opposite case to a list like this one, and both are true. You will not be asked these 101 questions word for word. You will be asked about the ten topics they come from, so the video works ten of them at a real terminal: the command, the output it actually prints, and a question pinned to every field of it. Watch that for the method, then use the list below to find the topics you cannot yet talk your way through.
Topics Covered
- Linux Fundamentals: Kernel, shells, root user, and the core differences between Linux and Unix.
- File System & Permissions: Files, directories, chmod, hard vs soft links, and the
/procfilesystem. - Processes & Scheduling: Process lifecycle, PIDs, signals, kill, cron jobs, and load average.
- Boot, Services & Runlevels: GRUB, systemd, daemons, systemctl, and boot targets.
- Package Management: apt, dnf, and zypper for installing, removing, and upgrading software across distributions.
- Storage, Memory & RAID: Filesystems, swap, disk space, virtual memory, and RAID arrays.
- Networking & SSH: SSH, network interfaces,
ip/ss, ping, traceroute, and sockets. - Security & User Management: Firewalls, iptables, SELinux, user accounts, and sudo vs su.
- IPC & Concurrency: Pipes, FIFOs, sockets, threads, fork, semaphores, and mutexes.
- Environment & Advanced Topics: Environment variables, PATH, shared libraries, regex, and device files.
All 101 Questions & Answers
1 · Linux Fundamentals
| # | Question | Answer |
|---|---|---|
| What is Linux? | Linux is a free and open-source operating system based on the Unix operating system. It was first created by Linus Torvalds in 1991 and has since become one of the most popular operating systems for servers, supercomputers, mobile devices, and embedded systems. | |
| What is the difference between Linux and Unix? | The main difference between Linux and Unix is that Linux is open-source software, while Unix is a proprietary operating system. Additionally, Linux is based on the Unix operating system and shares many similarities, but has evolved separately and has its own unique features and tools. | |
| What is a shell in Linux? | A shell is a command-line interface used to interact with the Linux operating system. It allows users to enter commands and execute programs, and provides a way to customize the behavior of the system. Some popular Linux shells include bash, zsh, and fish. | |
| What are some popular Linux shells? | Some popular Linux shells include bash, zsh, fish, csh, and ksh. Each shell has its own set of features and commands, and users may prefer one shell over another based on their personal preferences and needs. | |
| What is the root user in Linux? | The root user in Linux is the superuser account that has access to all commands and files on the system. The root user can perform any operation on the system, including creating, modifying, and deleting files and directories, installing and removing software, and managing system settings. It is recommended to use the root user account only when necessary, and to use a regular user account for everyday tasks. | |
| What is a Linux kernel? | The Linux kernel is the core of the Linux operating system. It is responsible for managing system resources, such as the CPU, memory, and input/output devices, and provides an interface between the hardware and software components of the system. The kernel is open-source software and can be customized and modified by developers and users. |
2 · File System & Permissions
| # | Question | Answer |
|---|---|---|
| How do you list all files in a directory in Linux? | To list all files in a directory in Linux, you can use the ls command with the -a option, which shows hidden files and directories. For example, the command ls -a /path/to/directory will list all files and directories in the specified directory, including hidden files. | |
| What is the difference between a file and a directory in Linux? | In Linux, a file is a collection of data that is stored on a storage device, while a directory is a special type of file that contains a list of other files and directories. Files can be accessed and modified by users and applications, while directories are used to organize and manage files. | |
| How do you create a new directory in Linux? | To create a new directory in Linux, you can use the mkdir command, followed by the name of the directory you want to create. For example, the command mkdir /path/to/new/directory will create a new directory named “directory” in the specified path. | |
| How do you change file permissions in Linux? | To change file permissions in Linux, you can use the chmod command, followed by a three-digit code that represents the permissions for the file. The first digit represents the owner permissions, the second digit represents the group permissions, and the third digit represents the permissions for other users. For example, the command chmod 644 /path/to/file will set the file permissions to read and write for the owner and read-only for the group and other users. | |
| What is chmod in Linux? | Chmod is a command in Linux used to change the permissions of a file or directory. It stands for “change mode” and allows the user to set read, write, and execute permissions for the owner, group, and other users. The permissions can be specified using either a symbolic representation or a numeric representation. | |
| What is the difference between a soft link and a hard link in Linux? | In Linux, a soft link (or symbolic link) is a file that points to another file or directory, while a hard link is a reference to a file that shares the same inode as the original file. Soft links can point to files or directories on different file systems, while hard links must be on the same file system as the original file. | |
What is the /proc filesystem in Linux? | The /proc filesystem is a virtual filesystem that provides a real-time window into the Linux kernel’s state. It does not contain actual files on disk, the kernel populates it dynamically. Key entries include /proc/cpuinfo (CPU details), /proc/meminfo (memory usage), /proc/PID/ (per-process information such as open file descriptors and memory maps), and /proc/sys/ (tunable kernel parameters accessible via sysctl). It is invaluable for runtime diagnostics and performance tuning. |
3 · Processes & Scheduling
| # | Question | Answer |
|---|---|---|
| What is a Linux process? | A process in Linux is an instance of a running program. It is a unit of execution that has its own memory space, system resources, and priority. Processes can be started and stopped by the user, and can communicate with each other through interprocess communication (IPC) mechanisms such as pipes and sockets. | |
| How do you check the system load in Linux? | To check the system load in Linux, you can use the uptime command, which shows the current time, the length of time the system has been running, and the average load over the last 1, 5, and 15 minutes. The load average represents the number of processes waiting for CPU time, and a high load average indicates a high level of system activity. | |
| What is a Linux cron job? | A Linux cron job is a scheduled task that runs automatically at a specific time or interval. Cron jobs are used for automated system maintenance, such as backups, log rotations, and database cleanup. The cron system in Linux uses a crontab file to define the schedule and command to run. The crontab file can be edited using the crontab command in the terminal. | |
| How do you schedule a cron job in Linux? | To schedule a cron job in Linux, you can use the crontab command to edit the crontab file. The crontab file contains a list of scheduled tasks and the commands to run. Each line in the crontab file specifies the time and frequency of the task, as well as the command to run. For example, to schedule a task to run every day at 2am, you can add the following line to the crontab file: 0 2 * * * /path/to/command. | |
| What is a Linux process ID (PID)? | A Linux process ID (PID) is a unique identifier assigned to each process running on a Linux system. The PID is used to identify and control the process, and can be used to send signals to the process, check its status, or terminate it. The PID is a number that is assigned sequentially when a process is started, and is recycled when the process terminates. | |
| How do you kill a process in Linux? | To kill a process in Linux, you can use the kill command, which sends a signal to the process to terminate it. The signal can be a specific signal, such as SIGTERM or SIGKILL, or a signal number. For example, to send a SIGTERM signal to a process with PID 1234, you can run the command kill 1234. If the process does not respond to the SIGTERM signal, you can use the SIGKILL signal to force it to terminate: kill -9 1234. | |
| What is a Linux file descriptor? | A Linux file descriptor is an integer value used to identify an open file or other data stream, such as a network socket or a pipe. The file descriptor is used by the system calls to perform operations on the file or data stream, such as reading, writing, or seeking. Each process has a table of file descriptors, which maps the file descriptor number to a file or stream. The standard input, output, and error streams are typically assigned file descriptor numbers 0, 1, and 2, respectively. | |
| How do you check the number of file descriptors in use in Linux? | To check the number of file descriptors in use in Linux, you can use the ulimit command with the -n option to display the maximum number of open file descriptors allowed for the current user, and the lsof command to display the list of open file descriptors and the processes that are using them. For example, to display the maximum number of open file descriptors, you can run the command ulimit -n, and to display the list of open file descriptors, you can run the command lsof -n. |
4 · Boot, Services & Runlevels
| # | Question | Answer |
|---|---|---|
| What is a Linux boot loader? | A Linux boot loader is a program that is responsible for loading the operating system into memory when the computer is turned on. It is typically installed in the Master Boot Record (MBR) of the hard drive and is the first program that runs during the boot process. The boot loader is responsible for detecting the operating system installed on the computer and loading the kernel into memory. | |
| What is GRUB in Linux? | GRUB (Grand Unified Bootloader) is the default boot loader used in many Linux distributions. It is a flexible and powerful boot loader that can boot multiple operating systems and handle complex boot configurations. GRUB allows the user to select the operating system and kernel to boot at startup, and can be configured to display a menu or boot the default operating system automatically. | |
| How do you troubleshoot a Linux boot problem? | To troubleshoot a Linux boot problem, you can start by checking the system logs to see if there are any error messages or warnings. You can also try booting the system in single-user mode to isolate the problem and check the system hardware and configuration. Some common issues that can cause boot problems include misconfigured boot loaders, hardware failures, and file system errors. | |
| What is a Linux runlevel? | A Linux runlevel is a mode in which the operating system runs with a predefined set of services and processes. Each runlevel corresponds to a certain configuration of system services, such as network, logging, and security. The default runlevel in most Linux distributions is usually runlevel 3 or 5, depending on whether the system uses a graphical user interface (GUI). | |
| How do you switch between runlevels in Linux? | To switch between runlevels in Linux, you can use the systemctl command. For example, to switch to runlevel 5 (the default runlevel for a system with a GUI), you can run the command sudo systemctl isolate graphical.target in the terminal. You can also switch to multi-user mode (runlevel 3) to perform system maintenance or troubleshooting with the command sudo systemctl isolate multi-user.target. | |
| What is a Linux daemon? | A Linux daemon is a background process that runs continuously and performs a specific task, such as managing network connections, monitoring system logs, or serving web pages. Daemons typically run as system services and are started and stopped automatically by the system. They are often named with a suffix of “d”, such as httpd for the Apache web server daemon. | |
| How do you start and stop a daemon in Linux? | To start a daemon in Linux, you can use the systemctl start command followed by the name of the service. For example, to start the Apache web server daemon, you can run the command sudo systemctl start httpd in the terminal. To stop a daemon, you can use the systemctl stop command. You can also use the restart option to stop and then start the daemon in a single command. |
5 · Package Management
| # | Question | Answer |
|---|---|---|
| How do you install a package in Linux? | To install a package in Linux, you can use a package manager such as apt, dnf, or zypper, depending on the distribution you are using. For example, to install the vim text editor in Ubuntu, you can run the command sudo apt install vim in the terminal. If you are using a Red Hat-based distribution such as Fedora or CentOS, you can use the dnf command instead: sudo dnf install vim. On SUSE-based distributions, you can use the zypper command: sudo zypper install vim. The package manager will automatically download and install the package and any dependencies. | |
| What is apt in Linux? | Apt is a command-line tool used to manage software packages in Debian-based Linux distributions such as Ubuntu. It is used to install, upgrade, and remove packages, as well as update the package list and resolve dependencies. The apt-get command is typically run with superuser privileges using the sudo command. | |
| How do you uninstall a package in Linux? | To uninstall a package in Linux, you can use the package manager to remove the package and any dependencies that are no longer needed. For example, to uninstall the vim text editor in Ubuntu, you can run the command sudo apt-get remove vim in the terminal. This will remove the package and any files or configuration settings associated with it. |
6 · Storage, Memory & RAID
| # | Question | Answer |
|---|---|---|
| What is a Linux swap partition? | A Linux swap partition is a dedicated space on a hard drive used as virtual memory by the operating system. When the system runs out of physical memory (RAM), it uses the swap partition to temporarily store data that is not being actively used. The swap partition is typically created during the installation of the operating system. | |
| How do you mount a file system in Linux? | To mount a file system in Linux, you can use the mount command, followed by the device name and the mount point. For example, the command mount /dev/sda1 /mnt will mount the file system on the device /dev/sda1 to the mount point /mnt. The file system will then be accessible in the specified directory. | |
| What is the difference between ext3 and ext4 file systems? | Ext3 and ext4 are both journaling file systems used in Linux. The main difference between them is that ext4 has more advanced features and is designed to handle larger file systems and larger files. Ext4 also has better performance and reliability compared to ext3. | |
| How do you check disk space usage in Linux? | To check disk space usage in Linux, you can use the df command, which shows the amount of free and used space on each file system. The command df -h will show the disk space usage in a more readable format, with sizes in gigabytes or megabytes instead of bytes. | |
| What is a Linux file system? | A Linux file system is the structure used to organize and store data on a Linux system. The file system defines how files are named, located, and accessed, as well as how directories and partitions are created and managed. Linux supports a variety of file systems, including ext2, ext3, ext4, Btrfs, XFS, and others, each with different features and performance characteristics. | |
| What is a Linux RAID? | A Linux RAID (Redundant Array of Independent Disks) is a system used to combine multiple hard disk drives (HDDs) into a single logical unit for the purpose of data redundancy, performance improvement, or both. A RAID system can provide fault tolerance by mirroring data across multiple drives, or by striping data across multiple drives with parity information. There are different RAID levels, such as RAID 0, RAID 1, RAID 5, and RAID 6, each with different features and tradeoffs. | |
| How do you configure RAID in Linux? | To configure RAID in Linux, you can use the mdadm utility, which is a Linux software RAID management tool. The mdadm command can be used to create, manage, and monitor RAID arrays, and to rebuild or repair failed disks in the array. For example, to create a RAID 1 array with two disks, you can run the command sudo mdadm —create /dev/md0 —level=1 —raid-devices=2 /dev/sda1 /dev/sdb1. You can also use the mdadm.conf file to configure RAID arrays at boot time. | |
| What is Linux virtual memory? | Linux virtual memory is a memory management technique that allows a process to use more memory than is physically available on the system by swapping data between RAM and disk. The Linux kernel uses a paging system to manage virtual memory, where pages of memory are moved between RAM and disk as needed to free up space for other processes. Virtual memory can improve system performance by allowing multiple processes to share memory, and by providing a way to run large applications that do not fit entirely in physical memory. | |
| How do you check memory usage in Linux? | To check memory usage in Linux, you can use the free command to display information about the system’s memory usage and availability. The free command can show the amount of free, used, and cached memory, as well as the total amount of memory and swap space. You can also use the top command to display a real-time view of the system’s memory usage and the processes that are using it. | |
| What is a Linux disk quota? | A Linux disk quota is a mechanism for limiting the amount of disk space that a user or group can use on a file system. Disk quotas are typically used to prevent users from using an excessive amount of disk space, which can cause performance problems or even bring down the system. Disk quotas can be applied to individual users or groups, and can be set on a per-file system basis. Linux supports both user and group quotas, and provides a number of tools for managing quotas. | |
| How do you set a disk quota in Linux? | To set a disk quota in Linux, you can use the setquota command, which is part of the quota package. The command takes two arguments: the name of the file system, and the name of the user or group. For example, to set a disk quota of 100 megabytes for the user john on the /home file system: setquota -u john 100M /home. You can also use the edquota command to edit quotas manually. |
7 · Networking & SSH
| # | Question | Answer |
|---|---|---|
| What is SSH in Linux? | SSH (Secure Shell) is a secure protocol used for remote access to a Linux system. It provides encrypted communication between the client and server, as well as secure authentication using public-key cryptography. SSH can be used to access a remote terminal or transfer files between systems. The SSH protocol is commonly used for remote system administration and for connecting to cloud-based services. | |
| How do you connect to a remote server using SSH in Linux? | To connect to a remote server using SSH in Linux, you can use the ssh command followed by the username and hostname of the remote system. For example, to connect to a server with the IP address 192.168.0.1 using the username “user”, you can run the command ssh [email protected] in the terminal. You will be prompted to enter the password for the remote user account. | |
| What is a Linux network interface? | A Linux network interface is a software component used to connect a Linux system to a network. The network interface can be a physical device, such as a network card or Wi-Fi adapter, or a virtual device, such as a loopback interface or a virtual private network (VPN) connection. Each network interface is identified by a unique name, such as eth0 or wlan0. | |
| How do you configure a network interface in Linux? | To configure a network interface in Linux, you can use the ip command. For example, to configure the eth0 interface with an IP address of 192.168.1.100 and a netmask of 255.255.255.0, you can run the command sudo ip addr add 192.168.1.100/24 dev eth0. You can also use the /etc/network/interfaces file to configure network interfaces at boot time. | |
| What is the netstat command in Linux? | The netstat command is a Linux utility used to display information about network connections, network interfaces, and routing tables. The command can be used to list active TCP and UDP connections, display network statistics, and diagnose network problems. The netstat command can be run with various options, such as -a to display all connections, -n to display addresses in numeric format, and -r to display the routing table. | |
| How do you check network connectivity in Linux? | To check network connectivity in Linux, you can use the ping command to send ICMP echo requests to a remote host and measure the response time. For example, to ping the Google DNS server at IP address 8.8.8.8, you can run the command ping 8.8.8.8 in the terminal. You can also use the traceroute command to trace the path of a network packet from the local host to a remote host, or the nslookup command to perform DNS lookups and resolve domain names to IP addresses. | |
| What is a Linux socket? | A Linux socket is a type of file descriptor that represents a network connection, such as a TCP/IP connection or a Unix domain socket. Sockets are used by network applications to communicate with each other over the network, and by system services to provide network access to applications. Sockets are identified by a combination of an IP address, a port number, and a protocol, and can be either stream-oriented or datagram-oriented. | |
| How do you create a socket in Linux? | To create a socket in Linux, you can use the socket system call, which creates a new socket and returns a file descriptor. The socket system call takes three arguments: the address family (AF_INET for IPv4, AF_INET6 for IPv6, or AF_UNIX for Unix domain sockets); the socket type (SOCK_STREAM for stream-oriented or SOCK_DGRAM for datagram-oriented); and the protocol (0 for the default, or a specific protocol number). For example, to create a new TCP/IP socket: int sockfd = socket(AF_INET, SOCK_STREAM, 0). | |
| What is a Linux network protocol? | A Linux network protocol is a set of rules that govern the communication between network devices. Linux supports a wide range of network protocols, including TCP/IP, UDP, ICMP, and others. Network protocols are typically implemented as software libraries or kernel modules that provide the necessary functionality for transmitting and receiving network packets. | |
| How do you specify a network protocol in Linux? | To specify a network protocol in Linux, you can use the socket system call, which creates a new socket file descriptor. The call takes three arguments: the domain (AF_INET for IPv4), the socket type (SOCK_STREAM for TCP), and the protocol (IPPROTO_TCP for TCP). For example, to create a TCP socket over IPv4: int sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);. |
8 · Security & User Management
| # | Question | Answer |
|---|---|---|
| What is a Linux firewall? | A Linux firewall is a software program or hardware device that controls access to a system or network by filtering network traffic. The firewall is designed to prevent unauthorized access or attacks by blocking incoming or outgoing traffic based on predefined rules or policies. Linux includes a built-in firewall called iptables, which can be used to configure network filtering and port forwarding. | |
| How do you configure a firewall in Linux? | To configure a firewall in Linux, you can use the iptables command to define the rules and policies for network filtering. The iptables command uses a set of chains and rules to determine how to handle network traffic. For example, to allow incoming traffic on port 80 (HTTP), you can run the command sudo iptables -A INPUT -p tcp —dport 80 -j ACCEPT. You can also configure the firewall using a graphical user interface, such as ufw (Uncomplicated Firewall) in Ubuntu. | |
| What is SELinux in Linux? | SELinux (Security-Enhanced Linux) is a security framework in Linux that provides a mandatory access control (MAC) system. SELinux is designed to enforce stricter security policies than traditional Unix-style permissions, by restricting the actions that a process can perform on a system. SELinux uses labels and policies to control access to system resources, and can be configured to provide fine-grained control over the actions of individual processes. | |
| How do you troubleshoot SELinux issues in Linux? | To troubleshoot SELinux issues in Linux, you can use the sealert command to analyze the system logs and identify potential security violations. The sealert command provides detailed information about the SELinux policy violations and suggests possible solutions. You can also use the setenforce command to temporarily disable SELinux enforcement for testing purposes, or use the audit2allow command to generate custom SELinux policies. | |
| What is a Linux user account? | A Linux user account is a system-level account that provides a specific user with access to the resources and privileges of the system. Each user account has a unique username and password, and is associated with a home directory and default shell. User accounts are used to manage system access and permissions, as well as to personalize the user’s environment and settings. | |
| How do you add a new user in Linux? | To add a new user in Linux, you can use the adduser or useradd command followed by the username of the new user. For example, to add a user named “john” to the system, you can run the command sudo adduser john in the terminal. You will be prompted to set a password and configure the user’s home directory and default shell. You can also add the user to specific groups and set custom permissions. | |
| What is the difference between su and sudo in Linux? | su (short for “substitute user”) and sudo (short for “superuser do”) are two commands in Linux used to switch to a different user account or execute a command with elevated privileges. The main difference between them is that su requires the root password to switch to the root account, while sudo uses the user’s own password to run a command as root. sudo also provides finer-grained control over which commands and options are allowed for each user, and logs all sudo commands for auditing purposes. | |
| What is the difference between /etc/passwd and /etc/shadow files in Linux? | The /etc/passwd and /etc/shadow files are two important system files in Linux used to manage user accounts and authentication. The /etc/passwd file contains information about each user account, such as the username, home directory, default shell, and user ID. The /etc/shadow file contains the encrypted passwords for each user account, as well as other security-related information. The main difference between the two files is that /etc/shadow is only readable by the root user, while /etc/passwd is readable by all users. | |
| What is a Linux log file? | A Linux log file is a text file used to record system events and activities, such as system startup and shutdown, application errors, security events, and other messages. Log files are an important tool for system administrators to monitor and troubleshoot the system, as they can provide valuable information about system behavior and performance. Linux uses a variety of log files, including system logs, application logs, and security logs, which are located in different directories and can be viewed using various tools. | |
| How do you view log files in Linux? | To view log files in Linux, you can use the tail or less command to display the last few lines of a file or scroll through the entire file. For example, to view the last 10 lines of the system log file, you can run the command sudo tail /var/log/syslog in the terminal. You can also use the grep command to search for specific messages or patterns in the log file. Many Linux distributions also include graphical log viewers, such as gnome-system-log and kSystemLog. |
9 · IPC & Concurrency
| # | Question | Answer |
|---|---|---|
| What is a Linux shared library? | A Linux shared library is a type of library that is loaded into memory at runtime and shared by multiple applications or processes. Shared libraries can contain executable code, data, or other resources, and can be used to provide common functionality to multiple programs, or to reduce the memory footprint of a program by sharing code and data among multiple instances. Shared libraries have a file extension of .so (shared object) on Linux, and can be linked to at compile time or loaded dynamically at runtime. | |
| How do you check for dependencies of a shared library in Linux? | To check for dependencies of a shared library in Linux, you can use the ldd command, which lists the shared libraries that a program or library depends on. For example, to list the shared libraries that the ls command depends on, you can run the command ldd $(which ls). | |
| What is a Linux thread? | A Linux thread is a lightweight process that shares the same memory space as the parent process, and can be used to perform multiple tasks concurrently within a single process. Threads are created and managed by the kernel or by a thread library, and can be used to implement parallelism or concurrency in a program. Threads have their own stack and instruction pointer, but share the same heap and global variables as the parent process. | |
| How do you create a thread in Linux? | To create a thread in Linux, you can use the pthread_create function from the POSIX threads API. The function takes four arguments: a pointer to a pthread_t object for the thread ID, a pointer to a pthread_attr_t object for thread attributes, a pointer to the thread entry function, and an optional argument to pass to that function. For example: pthread_create(&thread_id, NULL, thread_function, NULL). | |
| What is a Linux fork? | A Linux fork is a system call that creates a new process by duplicating the calling process. The new process, called the child process, is an exact copy of the parent process, with its own address space, file descriptors, and execution context. The child process starts executing at the same point as the parent process, but can have different behavior depending on the values of its variables and the actions it takes. The fork system call returns the process ID of the child process to the parent process, and returns 0 to the child process. | |
| How do you create a new process with fork in Linux? | To create a new process with fork in Linux, you can call the fork system call, which creates a new child process that is an exact copy of the parent process. The fork system call returns the process ID of the child process to the parent process, and returns 0 to the child process. The parent process can use the child process ID to wait for the child process to terminate or to communicate with it using interprocess communication mechanisms. | |
| What is a Linux pipe? | A Linux pipe is a mechanism for interprocess communication that allows the output of one process to be connected to the input of another process. A pipe is represented by a pair of file descriptors, one for the read end and one for the write end. The write end is used to write data to the pipe, and the read end is used to read data from the pipe. Pipes are typically used to implement filters or pipelines of commands, where the output of one command is passed as input to the next command. | |
| How do you create a pipe in Linux? | To create a pipe in Linux, you can use the pipe system call, which creates a pair of file descriptors for interprocess communication. The pipe system call takes an array of two integers as an argument, which will hold the file descriptors for the read and write ends of the pipe. For example: int pipefd[2]; pipe(pipefd);. | |
| What is a Linux semaphore? | A Linux semaphore is a synchronization primitive that can be used to coordinate access to shared resources between multiple processes or threads. A semaphore is represented by an integer value, and has two basic operations: wait and signal. The wait operation decrements the semaphore value, and blocks the calling process or thread if the resulting value is negative. The signal operation increments the semaphore value, and unblocks any processes or threads that are waiting on the semaphore. Semaphores can be used to implement locks, mutexes, and other synchronization mechanisms. | |
| How do you create a semaphore in Linux? | To create a semaphore in Linux, you can use the sem_init function, which initializes a semaphore with a given value. The function takes three arguments: a pointer to the semaphore object, a flag specifying whether the semaphore will be shared between processes, and the initial value. For example, to create a semaphore with an initial value of 1 shared between processes: sem_t sem; sem_init(&sem, 1, 1);. | |
| What is a Linux mutex? | A Linux mutex is a synchronization primitive that can be used to protect shared resources from concurrent access by multiple threads. A mutex is typically used to implement a critical section, which is a section of code that must be executed atomically. A mutex has two basic operations: lock and unlock. The lock operation acquires the mutex, which prevents other threads from entering the critical section. The unlock operation releases the mutex, which allows other threads to enter the critical section. | |
| How do you create a mutex in Linux? | To create a mutex in Linux, you can use the pthread_mutex_init function, which initializes a mutex with a given set of attributes. The function takes two arguments: a pointer to the mutex object, and a pointer to a pthread_mutexattr_t object that specifies the attributes. To create a mutex with the default attributes: pthread_mutex_t mutex; pthread_mutex_init(&mutex, NULL);. | |
| What is a Linux message queue? | A Linux message queue is a mechanism for interprocess communication that allows messages to be sent and received between processes. A message queue is represented by a message queue descriptor, which can be used to send or receive messages. Messages are typically sent using the msgsnd system call, which adds a message to the end of the queue. Messages are typically received using the msgrcv system call, which removes a message from the front of the queue. Message queues are typically used for tasks such as logging or remote procedure calls. | |
| How do you create a message queue in Linux? | To create a message queue in Linux, you can use the msgget system call, which creates a new message queue or returns the identifier of an existing one. The call takes two arguments: a key to identify the message queue, and a set of flags specifying access permissions. For example, to create a message queue with a key of 1234 and read/write permissions for the user: int msqid = msgget(1234, 0600 | IPC_CREAT);. | |
| What is a Linux signal handler? | A Linux signal handler is a function that is executed in response to a signal. Signals are used by the kernel to notify processes of various events, such as a segmentation fault or a user interrupt. A signal handler can be used to handle the signal, perform some action, and then return control to the program. Signal handlers are typically installed using the signal or sigaction system calls. | |
| How do you create a signal handler in Linux? | To create a signal handler in Linux, you can use the signal or sigaction system call to register a function to be called when a signal is received. The signal system call takes two arguments: the signal number and the function to be called. For example, to register a function called my_handler to handle the SIGINT signal: signal(SIGINT, my_handler);. The sigaction system call is more powerful and flexible, and allows for more control over signal handling. | |
| What is a Linux named pipe (FIFO)? | A Linux named pipe, also known as a FIFO (first in, first out), is a special type of file that allows two processes to communicate with each other. A named pipe is created using the mkfifo command, and has a name that is associated with it in the file system. One process can write data to the named pipe, and the other process can read the data from it. Named pipes are typically used for interprocess communication in situations where a more complex mechanism such as sockets or message queues is not needed. | |
| How do you create a named pipe in Linux? | To create a named pipe in Linux, you can use the mkfifo command, which creates a new file with the specified name and sets its file type to “fifo”. A named pipe can be used for interprocess communication between two or more processes. For example, to create a named pipe named “mypipe”: mkfifo mypipe. | |
| What is a Linux domain socket? | A Linux domain socket is a mechanism for interprocess communication that allows processes on the same host to communicate with each other using the network stack. A domain socket is similar to a network socket, but it does not use a network interface and does not require network configuration. A domain socket is identified by an address that consists of a path name in the file system. Domain sockets are typically used for high-performance communication between processes. | |
| How do you create a domain socket in Linux? | To create a domain socket in Linux, you can use the socket system call. It takes three arguments: the address family (usually AF_UNIX for a domain socket), the socket type (usually SOCK_STREAM), and the protocol (usually 0 for the default). For example: int sockfd = socket(AF_UNIX, SOCK_STREAM, 0);. |
10 · Environment & Advanced Topics
| # | Question | Answer |
|---|---|---|
| What is a Linux system call? | A Linux system call is a function provided by the Linux kernel that can be called by user space programs to perform privileged operations or to access system resources. System calls are typically used for tasks such as file I/O, process management, network communication, and memory management. System calls are the interface between user space programs and the kernel, and they provide a standardized way for programs to interact with the operating system. | |
| How do you call a system call in Linux? | You can call a system call in Linux using the syscall function, which is a low-level interface for invoking system calls. The syscall function takes a system call number and a variable number of arguments depending on the specific system call. For example, to call the open system call to open a file: syscall(SYS_open, path, flags, mode);, where path is the file path, flags are the open flags, and mode is the file mode. | |
| What is a Linux environment variable? | A Linux environment variable is a variable that is set in the environment of a Linux process. Environment variables are typically used to store configuration information or other data that needs to be shared between processes. Some examples of environment variables in Linux include PATH, which specifies the directories to search for executable files, and LD_LIBRARY_PATH, which specifies the directories to search for shared libraries. | |
| How do you set an environment variable in Linux? | To set an environment variable in Linux, you can use the export command, which adds the variable to the environment of the current shell. For example, to set the MYVAR environment variable to the value foo, you can run the command export MYVAR=foo. | |
| What is a Linux path variable? | A Linux path variable is an environment variable that is used to specify the directories to search for executable files. The most common path variable in Linux is the PATH variable, which is used by the shell to locate executable files. The PATH variable is a colon-separated list of directories that is searched in order. | |
| How do you add a directory to the PATH variable in Linux? | To add a directory to the PATH variable in Linux, you can modify its value using the export command. For example, to add the directory /usr/local/bin to the PATH variable, you can run the command export PATH=$PATH:/usr/local/bin. | |
| What is a Linux symbolic link? | A Linux symbolic link, also known as a soft link, is a type of file that contains a reference to another file or directory. Symbolic links can be used to create shortcuts or aliases to files or directories, or to provide a more convenient path to a file or directory. A symbolic link can be created using the ln command with the -s option. For example, to create a symbolic link to a file called file.txt: ln -s file.txt link.txt. | |
| How do you create a symbolic link in Linux? | To create a symbolic link in Linux, you can use the ln command with the -s option, followed by the name of the file or directory you want to link to, and the name of the link itself. For example, to create a symbolic link to a file called file.txt: ln -s file.txt link.txt. | |
| What is a Linux regular expression? | A Linux regular expression, also known as a regex, is a pattern that can be used to match text or data. Regular expressions are commonly used in Linux utilities such as grep and sed to search for or manipulate text. Regular expressions can contain a variety of special characters and syntax that allow for complex pattern matching. For example, the regular expression [a-z]+.txt would match any file name that ends with the .txt extension and contains only lowercase letters. | |
| How do you use regular expressions in Linux? | Regular expressions can be used in a variety of Linux utilities, such as grep, sed, and awk, to search for or manipulate text. Regular expressions can be included as part of the command line arguments for these utilities, or included in a script. For example, the command grep ‘[0-9]+’ file.txt would search the file file.txt for any lines that contain one or more digits. | |
| What is a Linux device file? | A Linux device file is a special file that provides access to a hardware device or a device driver. Device files are typically located in the /dev directory and can be accessed using standard file I/O operations. Each device file is associated with a major device number and a minor device number, which are used to identify the device and its driver. Device files can be of two types: character devices, which are accessed byte by byte, and block devices, which are accessed in fixed-size blocks. | |
| How do you create a device file in Linux? | To create a device file in Linux, you can use the mknod command, which creates a new device file with a specified major and minor device number. The command takes three arguments: the name of the device file, the file type (c for a character device or b for a block device), and the major and minor device numbers. For example, to create a character device file with major number 10 and minor number 1: mknod /dev/mydevice c 10 1. | |
| What is a Linux block device? | A Linux block device is a type of device that stores and retrieves data in fixed-size blocks, which are typically 512 bytes or larger. Block devices are used to store data that needs to be accessed randomly, such as file systems or databases. Block devices can be accessed using system calls such as read and write. | |
| How do you create a block device in Linux? | To create a block device in Linux, you can use the mknod command, which creates a special file that represents the block device. The command takes three arguments: the path to the special file, the file type, and the major and minor device numbers. For example, to create a block device at /dev/mydevice with major number 8 and minor number 0: mknod /dev/mydevice b 8 0. | |
| What is a Linux character device? | A Linux character device is a type of device that transfers data in a stream of bytes, with no fixed block size. Character devices are used to transfer data that is typically accessed sequentially, such as input and output from a keyboard or terminal. Character devices can be accessed using system calls such as read and write. | |
| How do you create a character device in Linux? | To create a character device in Linux, you can use the mknod command. The command takes three arguments: the name of the device file, the file type (c for a character device), and the major and minor device numbers. The major device number identifies the device driver, while the minor device number identifies a specific device instance. For example, to create a character device named mydevice with major number 240 and minor number 0: mknod mydevice c 240 0. | |
| What is Linux file locking? | Linux file locking is a mechanism that allows multiple processes to access the same file or resource without interfering with each other. File locking is typically used to prevent multiple processes from writing to the same file at the same time, which can lead to data corruption. In Linux, file locking can be implemented using the fcntl system call, which allows a process to place a lock on a region of a file. The fcntl system call takes a file descriptor, a lock type, and a lock region as arguments. | |
| How do you implement file locking in Linux? | To implement file locking in Linux, you can use the fcntl system call. The lock type can be either F_SETLK to set a lock, or F_GETLK to get information about an existing lock. The lock region is specified using a flock structure containing the starting byte offset and length of the region. For example, to set a write lock on the first 100 bytes of a file: fcntl(fd, F_SETLK, &lock), where lock is a flock structure specifying the region and lock type. | |
| What is a Linux environment? | A Linux environment refers to the set of variables and settings that are used by a shell or process. The environment includes variables such as the current working directory, the path to executable programs, and user-specific settings such as the shell prompt or the editor to use. The environment is typically inherited by child processes, which allows settings to be passed from one process to another. The environment can be modified using commands such as export, which sets a new variable or modifies an existing one, or source, which executes a shell script and updates the environment with any changes made by the script. |
Bonus: Modern Linux Tools for 2026
These topics appear frequently in current sysadmin and DevOps interviews. Familiarity with them separates mid-level candidates from senior ones.
| # | Question | Answer |
|---|---|---|
| 102 | What is systemd and how does it differ from SysV init? | systemd is the modern init system and service manager that has replaced SysV init in most major Linux distributions. Unlike SysV init, which starts services sequentially using shell scripts, systemd starts services in parallel using declarative unit files, significantly reducing boot time. It manages not only services but also mounts, timers, sockets, and devices. All management is done through systemctl, and all output is collected by journald and queried with journalctl. |
| 103 | What is a systemd unit file and what are its main sections? | A systemd unit file is a plain-text configuration file describing how a service, socket, timer, or other resource should be managed. Unit files live in /etc/systemd/system/ (admin-defined) or /usr/lib/systemd/system/ (package-installed). The three main sections are: [Unit], metadata and dependencies (Requires=, After=); [Service], how the process runs (ExecStart=, Restart=, User=); and [Install], when to enable the unit on boot (WantedBy=multi-user.target). |
| 104 | How do you diagnose a failed systemd service? | Start with systemctl status to see the current state and last log lines. Run journalctl -u to review the full service log since the last boot. Use systemctl —failed to list all failed units. Check dependencies with systemctl list-dependencies . Verify the binary and config paths defined in the unit file with systemctl cat . If you change the unit file, always run systemctl daemon-reload before restarting. |
| 105 | What is journald and how do you use journalctl? | journald is the systemd journal daemon that collects and stores structured, binary logs from the kernel, services, and applications. Unlike traditional syslog, it supports metadata fields and time-indexed queries. Key journalctl commands: journalctl -u nginx (logs for a specific service), journalctl -b (current boot), journalctl -b -1 (previous boot), journalctl -f (follow/tail mode), journalctl —since “1 hour ago” (time filter), journalctl -p err (errors only), and journalctl —vacuum-size=500M (trim journal size). |
| 106 | What command replaces netstat in modern Linux and why? | The ss (socket statistics) command replaces netstat, which is deprecated in the iproute2 package. ss is faster because it queries the kernel directly rather than parsing /proc/net. Common equivalents: ss -tuln (listening TCP/UDP ports, like netstat -tuln), ss -tp (TCP connections with PIDs), ss -s (summary statistics). The broader iproute2 replacements: ip addr replaces ifconfig, ip route replaces route, and ip neigh replaces arp. |
| 107 | What is nftables and how does it differ from iptables? | nftables is the modern Linux firewall framework, introduced in kernel 3.13 and the default in Debian 10+, RHEL 8+, and Ubuntu 20.04+. Unlike iptables, which uses separate tools for IPv4, IPv6, ARP, and bridge filtering, nftables unifies all of these in a single nft command. It offers a cleaner syntax, native support for sets and maps (for high-performance rule matching), and atomic ruleset updates. Configuration is stored in /etc/nftables.conf. Many distributions provide a compatibility layer via iptables-nft. |
| 108 | What is LVM and what are its three main components? | LVM (Logical Volume Manager) is a storage abstraction layer that enables flexible, online disk management without repartitioning. The three components are: Physical Volumes (PV), raw disks or partitions initialised with pvcreate /dev/sdb; Volume Groups (VG), one or more PVs pooled into a single storage pool with vgcreate my_vg /dev/sdb; and Logical Volumes (LV), flexible partitions carved from the VG with lvcreate -L 50G -n app_data my_vg. LVs can be resized (lvextend/lvreduce), snapshotted, and moved online without downtime. |
| 109 | What is the difference between AppArmor and SELinux? | Both are Linux Security Module (LSM) implementations that enforce Mandatory Access Control (MAC). SELinux (RHEL, Fedora, CentOS) labels every file, process, and resource and enforces policy based on those labels, highly granular but complex to configure. AppArmor (Ubuntu, Debian, SUSE) confines programs using file-path-based profiles, making policies easier to write and audit. SELinux is preferred in high-security and compliance-heavy environments; AppArmor is easier to adopt for general application confinement. Both can run in enforcing or permissive (log-only) modes. |
Bonus: Scenario-Based Interview Questions
Scenario-based questions are now standard at the L2/L3 level and in DevOps interviews. Practice talking through your reasoning out loud.
| # | Scenario | Approach |
|---|---|---|
| S1 | A production server shows a load average of 50 on a 4-core machine. Walk through your diagnosis. | A load average of 50 on 4 cores (12.5× the core count) indicates severe saturation. First, run top or htop, processes in R state signal CPU starvation; processes in D state (uninterruptible sleep) signal I/O blocking. Use vmstat 1 to check CPU wait (wa), steal (st), and context switch rate. Run iostat -xz 1 to identify saturated disks. Use ps aux —sort=-%cpu to find top CPU consumers and iotop for I/O. Check dmesg for disk hardware errors. |
| S2 | The root filesystem is 100% full and you cannot write any files. What do you do? | (1) Run df -h to confirm and locate the full filesystem. (2) Find large directories: du -sh /var/log/* /tmp/*. (3) Clear journal logs: journalctl —vacuum-size=200M. (4) Clear package caches: apt clean or dnf clean all. (5) Find large files: find / -xdev -size +100M 2>/dev/null. (6) Check for deleted-but-open files holding space: lsof +L1, restart the offending process to release the space. (7) If blocks are free but writes fail, check inodes with df -i. |
| S3 | A service that was running yesterday is not starting after a reboot. How do you debug it? | Run systemctl status for the exit code and last log lines. Check the full boot log with journalctl -u . List failed dependencies with systemctl list-dependencies . Verify the binary path and config via systemctl cat . Check file permissions and ownership. Confirm no port conflict: ss -tlnp | grep . Look for override files in /etc/systemd/system/. Manually run the ExecStart= command as the service user to reproduce the error interactively. |
| S4 | You need to give a developer SSH access to a server but restricted to a specific directory. How do you implement this? | Use an SSH chroot jail. In /etc/ssh/sshd_config, add a Match User devuser block with ChrootDirectory /srv/devuser and ForceCommand internal-sftp (SFTP only) or a restricted shell. The chroot directory must be owned by root with permissions 755; create a writable subdirectory inside it owned by the user. For shell access, combine rbash with a limited PATH and prevent shell re-execution. Reload sshd after changes: systemctl reload sshd. |
| S5 | A user reports their cron job is not running. How do you troubleshoot it? | (1) Verify the job exists: crontab -l -u username. (2) Check cron is running: systemctl status cron. (3) Review logs: grep CRON /var/log/syslog or journalctl -u cron. (4) Ensure the script is executable: ls -la /path/to/script.sh. (5) Cron uses a minimal PATH, always use absolute paths in cron scripts and add PATH=/usr/local/sbin:… at the top of the crontab. (6) Capture output in the crontab entry: * * * * * /path/script.sh >>/tmp/cron.log 2>&1 to surface hidden errors. (7) Check if MAILTO is set and whether the MTA is delivering mail. |
Conclusion
Linux is a powerful operating system with a wide range of features and capabilities. Knowing the answers to common Linux interview questions is an essential part of preparing for a job in the field. We hope this list of 101 Linux interview questions has given you a solid foundation for your next interview.