Class 54 of 55 • Practice & Resources
100+ Top Linux Interview Questions & Answers Master Guide
An exhaustive, categorized compilation of real-world Linux interview and college viva questions covering Architecture, Commands, File Systems, Permissions, Processes, LVM, Networking, Security, and Troubleshooting.
Whether you are a BCA, MCA, or Computer Science student preparing for your university viva voce, or a practicing engineer preparing for Red Hat Certified System Administrator (RHCSA), LFCS, or cloud DevOps job interviews, technical mastery of Linux internals is essential.
Below is our curated master handbook of real-world Linux questions divided into eight specialized categories. Click on each question to reveal its in-depth explanation and command demonstrations.
Category 1: Linux Fundamentals & Kernel Architecture
Technically, Linux is only a kernel—the core supervisory program created by Linus Torvalds that controls CPU scheduling, memory management, and hardware device drivers. Ubuntu, Red Hat, and Debian are Linux Distributions (distros). They combine the Linux kernel with the GNU software userland (compiler, bash shell, coreutils), system services (systemd), package managers (APT/DNF), and desktop environments (GNOME).
A Monolithic Kernel (like Linux) executes all core operating system services—file systems, VFS, networking stacks, process scheduling, and device drivers—within a single unified supervisor address space (Kernel Space). This delivers maximum execution speed because internal components communicate via direct C function calls rather than IPC message passing. A Microkernel (like Mach or QNX) runs only primitive scheduling and IPC in kernel space, running drivers and filesystems as isolated user-space servers.
LKMs are object code binaries (with
.ko extension) that can be dynamically loaded into and unloaded from kernel memory at runtime without rebooting the system or recompiling the kernel. Common tools include lsmod (list loaded modules), modinfo, modprobe (loads module with dependency resolution), and rmmod.
Swap space is dedicated disk storage (either a dedicated swap partition or swap file) used as virtual memory overflow. When physical RAM becomes constrained, the kernel memory manager pages inactive anonymous memory pages out of RAM into swap. You inspect swap with
free -h, swapon --show, and tune kernel swapping aggressiveness via /proc/sys/vm/swappiness (0 to 100).
Category 2: File System, Inodes & Storage Architecture
An Inode (Index Node) is a 256-byte data structure on disk that uniquely identifies a file. It stores file metadata: file size, ownership (UID/GID), permissions (rwx), file type, timestamps (atime, mtime, ctime), link count, and pointers to physical disk data blocks. Crucially, the inode does NOT store the filename or file contents; filenames are stored in directory tables mapping strings to inode numbers.
Ext4 and XFS allocate a fixed maximum number of inodes during filesystem creation (format time). If an application (like a misconfigured email queue or cache directory) generates millions of tiny 0-byte or 1-byte files, the inode table exhausts completely. The system throws a
No space left on device error when creating any new file, even though df -h shows ample free gigabytes. You detect this using df -i.
A Hard Link creates another directory entry pointing to the same exact inode number. Deleting the original file path does not destroy the data as long as link count > 0. Hard links cannot span across different filesystems and cannot link to directories. A Soft Link (Symlink) (
ln -s) is an independent file with its own inode that stores the text path of the target. If the target file is deleted or renamed, the symlink becomes a broken / dangling pointer. Symlinks can cross partition boundaries and link to directories.
VFS is an abstraction layer in the Linux kernel that provides a standardized set of POSIX system calls (
open, read, write, close) to user-space applications regardless of the underlying storage format. VFS transparently routes calls to concrete drivers (ext4, XFS, Btrfs, NFS, ISO9660, /proc).
Category 3: Essential Commands & Text Processing
grep searches text using Basic Regular Expressions (BRE). egrep (or grep -E) supports Extended Regular Expressions (ERE) without requiring backslashes for special characters like +, ?, |, and (). fgrep (or grep -F) searches for fixed string literals without evaluating any regular expression syntax, making it significantly faster for massive log searches.
sudo find /var/log -type f -mtime +30 -exec rm -f {} +
# Or using the native -delete flag:
sudo find /var/log -type f -name "*.log" -mtime +30 -delete
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -n 10
In Linux, standard file descriptors are:
0 (stdin), 1 (stdout), and 2 (stderr). To redirect standard output to a file, use > file.txt or 1> file.txt. To redirect errors only, use 2> errors.log. To redirect both streams into a single log file, use &> all_output.log or > log.txt 2>&1.
Category 4: Users, Groups & File Permissions
Example:
1. Username (
2. Password placeholder
3. User ID / UID (
4. Primary Group ID / GID (
5. GECOS / User comments (Full Name, Office)
6. Home directory absolute path (
7. Default login shell (
john:x:1001:1001:John Doe,IT Dept:/home/john:/bin/bash1. Username (
john)2. Password placeholder
x (encrypted hash stored securely in /etc/shadow)3. User ID / UID (
1001)4. Primary Group ID / GID (
1001)5. GECOS / User comments (Full Name, Office)
6. Home directory absolute path (
/home/john)7. Default login shell (
/bin/bash).
umask (User File-Creation Mode Mask) defines permissions automatically subtracted from default maximums when creating files (default max 666) or directories (default max 777). With a umask of 022:New file permissions: $666 - 022 = \mathbf{644}$ (
rw-r--r--)New directory permissions: $777 - 022 = \mathbf{755}$ (
rwxr-xr-x).
The Sticky Bit (octal
1000, represented as t at the end of permissions: drwxrwxrwt) ensures that within a world-writable directory (like /tmp), only the file's owner or root can delete, rename, or modify that file. Without the sticky bit, any user could delete another user's files inside /tmp.
SUID (4000): When an executable binary with SUID (e.g.
SGID (2000): On a binary, it runs with the group owner's permissions. On a directory, any new files or subfolders created inside automatically inherit the parent directory's group ownership rather than the primary group of the user who created it (essential for collaborative team shares).
/usr/bin/passwd) is run by an unprivileged user, it executes with the privileges of the file owner (root), allowing users to update their own password hash in /etc/shadow.SGID (2000): On a binary, it runs with the group owner's permissions. On a directory, any new files or subfolders created inside automatically inherit the parent directory's group ownership rather than the primary group of the user who created it (essential for collaborative team shares).
Category 5: Process Management & Signals
An Orphan Process is a process whose parent process terminated before it finished. Orphan processes are immediately adopted by
A Zombie Process (state
systemd (PID 1) and continue executing normally until completion.A Zombie Process (state
Z in ps) is a process that has finished execution via exit(), but its parent has not yet executed the wait() system call to read its exit status code. A zombie consumes no memory or CPU, but it occupies an entry in the system process table.
SIGTERM (Signal 15): The polite termination request. The target application can catch or trap this signal, flush in-memory buffers to disk, finish active transactions, close open socket descriptors, and exit gracefully.
SIGKILL (Signal 9): The unconditional kill signal handled directly by the Linux kernel. The process is aborted immediately without notice; it cannot catch, block, or ignore SIGKILL. Used only when an application fails to respond to SIGTERM.
SIGKILL (Signal 9): The unconditional kill signal handled directly by the Linux kernel. The process is aborted immediately without notice; it cannot catch, block, or ignore SIGKILL. Used only when an application fails to respond to SIGTERM.
Niceness ranges from
-20 (highest priority, least nice to other processes) to +19 (lowest priority, very nice to others). Default priority is 0. Regular users can only increase their process's niceness (lowering priority); only root can assign negative values to boost CPU scheduling priority via the CFS (Completely Fair Scheduler).
State
D represents a process blocked waiting for hardware or network I/O (such as waiting for a disk block from an unresponsive NFS server). The kernel puts the process in an uninterruptible sleep state to prevent filesystem corruption. A process in D state cannot be killed even by kill -9; it only clears once the I/O completes or the server is rebooted.
Category 6: Storage Management & LVM
1. Physical Volume (PV): Raw disk drives or partitions initialized with
2. Volume Group (VG): A unified storage storage pool aggregating multiple PVs created via
3. Logical Volume (LV): Virtual partitions carved out of the VG with
pvcreate /dev/sdb1.2. Volume Group (VG): A unified storage storage pool aggregating multiple PVs created via
vgcreate vg_data /dev/sdb1 /dev/sdc1.3. Logical Volume (LV): Virtual partitions carved out of the VG with
lvcreate -L 50G -n lv_web vg_data, formatted with a filesystem and mounted like standard disks.
# 1. Extend the Logical Volume size by 20GB and resize ext4 filesystem automatically:
sudo lvextend -L +20G /dev/vg_data/lv_web -r
# 2. For XFS filesystems (if -r was omitted):
sudo xfs_growfs /mnt/web
Category 7: Networking, DNS & Firewalls
ifconfig belongs to the legacy 1990s net-tools package. It uses outdated ioctl system calls, cannot handle policy routing, network namespaces, multiple IP aliases per interface natively, or modern IPv6 configurations correctly. iproute2 (the ip suite) communicates directly with kernel Netlink sockets and provides unified link, address, and routing management.
1. SYN: Client sends a SYN packet with Initial Sequence Number (ISN=X) → enters
2. SYN-ACK: Server acknowledges with Ack=X+1 and sends its own Sequence Number (Seq=Y) → enters
3. ACK: Client sends ACK with Ack=Y+1 → both enter
SYN_SENT.2. SYN-ACK: Server acknowledges with Ack=X+1 and sends its own Sequence Number (Seq=Y) → enters
SYN_RECV.3. ACK: Client sends ACK with Ack=Y+1 → both enter
ESTABLISHED. Full-duplex data transfer begins.
Category 8: Systemd, Security & Troubleshooting
systemctl restart stops the daemon completely (killing child worker processes and severing active client TCP connections) and spawns a fresh process. systemctl reload sends a SIGHUP signal instructing the running daemon (like Nginx) to re-read its configuration files on disk without terminating worker processes or dropping active user sessions (zero-downtime configuration reload).
1. Reboot the server and press e at the GRUB menu.
2. Locate the line starting with
3. Press Ctrl + X to boot into single-user emergency shell.
4. Remount root filesystem as read-write:
5. Chroot into system:
6. Reset password:
7. Force SELinux relabeling if applicable:
2. Locate the line starting with
linux and append rd.break (RHEL) or init=/bin/bash (Ubuntu/Debian) to the end.3. Press Ctrl + X to boot into single-user emergency shell.
4. Remount root filesystem as read-write:
mount -o remount,rw /sysroot (or /).5. Chroot into system:
chroot /sysroot.6. Reset password:
passwd root.7. Force SELinux relabeling if applicable:
touch /.autorelabel and reboot.
You may also like this!
© Veewom.com. | Managed by PinePL
