Linux Interview Questions: 24 Questions with Answers

Linux comes up in interviews for DevOps engineers, system administrators, SREs and backend developers. Interviewers rarely expect you to remember flags by heart: they want to know whether you understand how the system works and whether you can find the cause of a problem. Below are the Linux interview questions that come up most often, from basic to diagnostic, with answers and commands.

Tip: when you answer, name the command you would use to verify your claim. The phrase "I'd check it with ss -tlnp" sounds far more convincing than general statements.

File system

1. What is FHS, and what lives in the main directories?

FHS (Filesystem Hierarchy Standard) is the standard for the layout of directories. The whole tree starts at the root /; there are no separate drives with letters — other file systems are mounted into directories of the tree.

• /etc — configuration of the system and services;
• /var — changing data: logs (/var/log), cache, queues, databases;
• /home — user home directories, /root — the home directory of root;
• /usr — programs and libraries; /bin and /sbin on modern distributions are usually links to /usr/bin and /usr/sbin;
• /tmp — temporary files, /boot — the kernel and bootloader;
• /proc and /sys — virtual file systems with information about processes and the kernel, /dev — device files.

2. What is an inode?

An inode is a file system structure that stores a file's metadata: type, permissions, owner, size, timestamps, the number of hard links, and pointers to the blocks with the data. The file name is not stored in the inode: the name is kept in the directory as a record "name → inode number".

The inode number is shown by ls -i, details by stat file. The number of inodes on a file system is limited, and df -i shows how many are used. This gives the classic situation: "there is plenty of disk space, but I cannot create a file" — the inodes have run out because of millions of tiny files.

3. How does a hard link differ from a symbolic link?

A hard link (ln file link) is another name for the same inode. Both names are equal, and the data is deleted only when the link counter reaches zero. Limitations: you cannot link to a directory, and you cannot cross the boundaries of one file system.

A symbolic link (ln -s target link) is a separate file with its own inode, which stores the path to the target. It can point to a directory and to another file system, but it "breaks" if the target is deleted or moved.

4. The disk is full, but du shows less than df. Why?

Most often a file was deleted, but some process still holds it open — for example, a large log of a running service was removed. The name is gone, so du does not see it, but the blocks stay occupied, and df counts them.

To find such files use lsof +L1 or lsof | grep deleted. The fix is to restart the process or truncate the file through its descriptor: : > /proc/PID/fd/N. In future, logs should be cleaned with truncate or logrotate rotation, not with rm.

5. How does Linux boot?

The firmware (BIOS or UEFI) initializes the hardware and hands control to the bootloader, usually GRUB. The bootloader reads its configuration, loads the kernel and the initramfs — a temporary root file system with the drivers needed to reach the real root — into memory.

The kernel initializes devices, mounts the root file system and starts the first user-space process with PID 1 — on most distributions this is systemd. It brings up services up to the default target, for example multi-user.target. The time of each stage is shown by systemd-analyze.

6. What does the mount command do, and where is automatic mounting described?

mount attaches a file system from a device to a directory (the mount point): mount /dev/sdb1 /mnt/data. Current mounts are shown by findmnt or by mount without arguments.

Mounting at boot is described in /etc/fstab. It is better to specify devices there by UUID (shown by blkid) rather than by name such as /dev/sdb1, which may change. Before a reboot the changes are checked with mount -a: an error in fstab can stop the boot.

Users and permissions

7. How are permissions in Linux organized?

Every file has an owner, a group and three sets of permissions: for the owner, for the group and for everyone else. Each set is r (read), w (write) or x (execute). In numeric form r=4, w=2, x=1, so chmod 640 file gives the owner read and write, the group read, and others nothing.

$ ls -l app.conf
-rw-r----- 1 deploy www-data 512 Oct 12 10:03 app.conf

The owner is changed with chown user:group file, permissions with chmod.

8. What do r, w and x mean for a directory?

For a directory the meaning is different: r — you can get the list of names, w — you can create, delete and rename files inside, x — you can enter the directory and access files by name.

An important consequence: you can delete a file if you have write permission on the directory, even if the file does not belong to you. Without x on the directory, r alone does not help: the names are visible, but the files cannot be opened.

9. What are SUID, SGID and the sticky bit?

SUID on an executable runs the program with the rights of its owner, not of the user. A classic example is /usr/bin/passwd: it belongs to root and can change /etc/shadow. SGID on a file does the same for the group, and on a directory it makes new files inherit the directory's group, which is convenient for shared folders.

The sticky bit on a directory allows only a file's owner to delete it, even if the directory is writable by everyone. This is how /tmp works: ls -ld /tmp shows drwxrwxrwt. To find all SUID files for an audit: find / -perm -4000 -type f 2>/dev/null.

10. What is umask?

umask is a mask that removes permissions from new files and directories. The base permissions are 666 for files and 777 for directories, and the umask subtracts bits from them. With a typical umask 022, files are created with 644 and directories with 755. The current value is shown by the umask command.

11. Where are users and passwords stored?

Accounts are stored in /etc/passwd: name, UID, the primary group's GID, home directory and shell. Password hashes are moved to /etc/shadow, which only root can read — so the hashes are not available to ordinary users for brute-forcing. Groups are described in /etc/group.

Information about a user is conveniently viewed with the commands id user and getent passwd user — the second also takes external sources such as LDAP into account.

12. How does sudo work, and why is it better than logging in as root?

sudo runs a command as another user (by default root) according to the rules in /etc/sudoers and the files in /etc/sudoers.d/. The user enters their own password, not the root password, and every action is written to the log with the name of the person who did it.

A rule can allow everything (alena ALL=(ALL:ALL) ALL) or specific commands. Edit sudoers only through visudo: it checks the syntax before saving, so a mistake will not lock you out of sudo. On Ubuntu administrator rights are granted by membership in the sudo group, on RHEL-like systems in the wheel group.

13. How do you add a user to a group, and why did the changes not apply?

The command usermod -aG docker alena adds a user to a supplementary group. The -a flag is required: without it -G replaces the whole list of groups.

Changes take effect at the next login: the current session keeps the old group list. You can log out and back in, or open a shell with the new group using newgrp docker. Check with id.

Processes

14. What is a process and a PID, and how do you list processes?

A process is a running program with its own address space, open files and a PID identifier. Each process has a parent (PPID); the common ancestor is the process with PID 1. The process list is shown by ps aux and ps -ef, the tree by pstree or ps -ef --forest, and in real time by top and htop.

15. How do the SIGTERM and SIGKILL signals differ?

kill PID sends SIGTERM (15) by default — a polite request to terminate. The process can catch it, close connections, save data and exit. SIGKILL (9, kill -9) cannot be caught: the kernel ends the process immediately, without cleanup.

The correct order is SIGTERM first, and only if the process does not react — SIGKILL. Another common signal is SIGHUP: many daemons re-read their configuration on it.

16. What is a zombie process?

A zombie is a process that has already finished, but its parent has not yet read its exit code with the wait() call. It uses almost no resources but keeps an entry in the process table. In ps its state is Z.

You cannot kill a zombie: it is already dead. The parent has to "bury" it — fix the parent program, or terminate the parent, and then the zombie is inherited by PID 1, which removes it.

17. What does the load average show?

The three numbers in uptime and top are the average number of processes waiting to run over 1, 5 and 15 minutes. On Linux this also includes processes in uninterruptible sleep (state D), usually waiting for a disk.

The value is compared with the number of cores (nproc): a load of 4 on 4 cores is full utilization, on 16 cores it is a quarter. A high load with low CPU usage points to an I/O problem; this is checked with iostat or the wa field in top.

Networking

18. How do you see IP addresses, routes and open ports?

Interface addresses — ip a, the routing table — ip r. The old ifconfig and netstat from the net-tools package are not installed by default on many distributions.

Listening ports and the processes that opened them are shown by ss -tlnp: t — TCP, l — listening only, n — no name resolution, p — with the process. For UDP — ss -ulnp.

$ sudo ss -tlnp
State  Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0      511          0.0.0.0:80        0.0.0.0:*     users:(("nginx",pid=812,fd=6))
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*     users:(("sshd",pid=640,fd=3))

19. A service listens on 127.0.0.1:8080 — can you connect to it from outside?

No. The address 127.0.0.1 is the loopback interface, reachable only from the same machine. To accept external connections, the service must listen on the external interface's address or on 0.0.0.0 (all IPv4 addresses). This is a common cause of "the port is open, but it does not work from outside", alongside the firewall.

20. How does Linux turn a host name into an IP address?

The order of sources is set by the hosts: line in /etc/nsswitch.conf, usually the file /etc/hosts first, then DNS. DNS server addresses are taken from /etc/resolv.conf; on systems with systemd-resolved that file points to the local address 127.0.0.53, and the real servers are shown by resolvectl status.

For checking use dig example.com or dig @1.1.1.1 example.com (a query to a specific server). An important subtlety: dig and nslookup query DNS directly and do not read /etc/hosts, while getent hosts example.com goes the same way applications do.

21. How does TCP differ from UDP?

TCP establishes a connection (a three-way handshake: SYN, SYN-ACK, ACK), guarantees delivery and order of data, and retransmits lost packets. HTTP, SSH and most databases run on it. UDP sends datagrams without a connection or guarantees, but with lower latency — it is used for DNS queries, video calls and games.

22. A website does not open. How will you look for the cause?

Go through the layers, from the name to the application:

1. Does the name resolve: dig site.example, does the address match the expected one.
2. Is the host reachable: ping (may be blocked), traceroute or mtr.
3. Is the port open: nc -zv host 443 or curl -v https://site.example.
4. On the server: is the service running (systemctl status nginx), is the port listening (ss -tlnp), is the firewall blocking it (sudo nft list ruleset, sudo ufw status).
5. The application logs and journalctl -u for the service.

What the interviewer values is the systematic order, not a specific set of utilities.

23. What is the TIME_WAIT state?

After a TCP connection is closed, the side that closed it first keeps the socket in TIME_WAIT for some time, so that late packets from the old connection do not end up in a new one with the same addresses and ports. A large number of TIME_WAIT sockets is normal for a busy server or a client that makes many short connections. You can count them with ss -tan state time-wait | wc -l.

24. How do /etc/hosts and DNS differ, and when is the first one needed?

/etc/hosts is a local static table of "address — name" on a particular machine. It is checked before DNS (with a standard nsswitch) and is useful for testing: for example, pointing a domain to a new server before changing the DNS records. DNS is a distributed system whose answers are seen by all clients. A mistake in /etc/hosts is a common reason for the situation "the site opens for me but not for anyone else".

Summary

Typical Linux interview questions test three things: whether you understand the model of the system (inodes, permissions, processes, boot), whether you know the diagnostic tools (ss, dig, journalctl, lsof), and whether you can search for the cause step by step. Answer with commands and examples from practice. The file system, permissions and networking are covered in detail in our Linux course.