Linux Interview Questions

What should you focus on for a Linux interview?

Start with the most asked questions below. Use them to check which commands you can explain and which tasks you can work through. Then check scripting, the topic covered in the most interviews.

Which basic questions should you check first?

Changing file ownership and permissions, finding what fills a disk, and listing running processes each appeared in 4 of 94 interviews. Use these questions to check your command knowledge:

• Can you explain how to change file ownership, group ownership, and permissions?
• Can you show how to list currently running processes?
• Can you explain the difference between a symbolic link and a hard link?
• Can you create a directory from the command line?
• Can you name the commands you commonly use for administration and say what each does?

Also check whether you can explain the difference between kill and kill -9, including what SIGKILL does.

What scripting tasks should you try?

Shell scripting and automation was the most common topic, appearing in 37 of 94 interviews. It covered Bash, cron, script safety, command output, PowerShell, and automation across operating systems. Your checks should go beyond Bash syntax.

Writing code was part of 7 of 94 interviews. Try these tasks from the interviews:

• Check a process's status every two minutes and log the result.
• Parse and validate a command's JSON output. Handle non-zero exit codes and partial or malformed JSON.
• Write a safe cleanup script for files older than thirty days. Handle spaces, logging, and deletion failures.

Can you also describe an administrative task you would automate with PowerShell or Bash and explain what the script would do?

Can you work through a disk or performance problem?

Check whether you can use df to read filesystem disk usage. Then explain how you would find what is taking up space and safely free it.

For performance questions, can you describe how you would check CPU, memory, load averages, and logs? Can you explain how you would investigate an application crash or a web server problem?

Can you explain access, networking, and services?

Use these checks for the security, networking, and service questions:

• Can you explain how you handle users, permissions, privileged access, and SSH keys?
• Can you describe how you would check authentication logs?
• Can you explain how you would investigate DNS, ports, routing, or an SSH connection problem?
• Can you describe how you use systemd and systemctl to manage services and investigate failures?

Who gets asked Linux

The 20 most asked Linux questions

Counted by interview, not by mention: a question asked twice in one conversation counts once.

1. How do you change file ownership, group ownership, and permissions in Linux?

   Asked in 4 of 94 interviews · last asked Sep 19 · Tooling · Junior

   Show answer

   Use `chown` to change the owner, `chgrp` to change the group, and `chmod` to change permissions. You can change both owner and group with `chown user:group file`. Use symbolic permissions, like `u+x`, or numeric permissions, like `640`. Changing the owner normally requires root privileges.

   • Permissions apply to owner, group, and others; read, write, and execute have values 4, 2, and 1.
   • A file’s owner can change its permissions and assign it to a group they belong to.
   • For directories, execute allows traversal; write and execute together normally allow creating or deleting entries.
   • Use `-R` carefully: it applies changes recursively, including to files and subdirectories.

   CodeCopy

   sudo chown alice report.txt
   sudo chgrp developers report.txt
   sudo chown alice:developers report.txt
   # Owner: read/write; group: read; others: no access.
   chmod 640 report.txt
   # Give the owner execute permission.
   chmod u+x script.sh

   What the interviewer checks: The interviewer checks whether you can choose the right commands and explain permission bits and privilege limits.

   Other ways it was asked

   • “How do you change a file’s permissions in Linux?”
   • “How do you change file and directory ownership and permissions in Linux, including assigning them to a user or group?”
   • “What command do you use to change permissions?”

2. How would you find what is filling a Linux disk and safely free up space?

   Asked in 4 of 94 interviews · last asked Oct 7 · Scenario · Mid-level

   Show answer

   I use `df -h` and `df -i` to check disk space and inode use. Then I use `du` and `find` on the affected filesystem to locate large directories and files. I remove only confirmed disposable data, following log retention rules. If deleted files are still open, I arrange a safe restart of the process holding them.

   • Check inode use: many small files can fill a filesystem without using all its space.
   • Keep searches on the affected filesystem; `du -x` and `find -xdev` avoid crossing filesystem boundaries.
   • Use `lsof +L1` to find deleted files that open processes still hold.
   • Do not blindly delete logs or application data; check retention rules and verify space afterward.

   CodeCopy

   df -h
   df -i
   # Replace / with the affected filesystem's mount point.
   sudo du -xhd1 / | sort -h
   sudo find / -xdev -type f -size +500M -printf '%s %p\n' | sort -nr | head -20
   sudo lsof +L1

   What the interviewer checks: The interviewer checks whether you can locate the cause and recover space without losing needed data or disrupting services.

   Other ways it was asked

   • “A disk is running out of space. How would you quickly identify what is consuming it?”
   • “How would you debug a Linux server that is 95% full and free up disk space?”
   • “How would you identify and filter for files that are consuming disk space on a Linux server?”

3. How do you list currently running processes in Linux?

   Asked in 4 of 94 interviews · last asked Jul 16 · Tooling · Junior

   Show answer

   Use `ps aux` or `ps -ef` to list all current processes. Use `top` for a live view, or `htop` if it is installed. These commands also show sleeping processes, not just processes using the CPU right now.

   • `ps` shows a snapshot; `top` refreshes automatically.
   • The output includes process IDs, owners, and command names.
   • Plain `ps` normally shows only your processes attached to the current terminal.

   CodeCopy

   ps aux

   What the interviewer checks: The interviewer is checking whether you can list processes and choose between a snapshot and a live view.

   Other ways it was asked

   • “In Linux, how do you see the currently running processes?”
   • “How can you see which processes are running on a Linux machine?”
   • “Which Linux commands can you use to list running processes?”

4. What is the difference between a symbolic link and a hard link?

   Asked in 3 of 94 interviews · last asked Aug 30 · Concept · Junior

   Show answer

   A hard link is another name for the same file, sharing its inode and data. A symbolic link is a separate file that stores a path to its target. Removing one hard link leaves the other names usable. A symbolic link breaks if its target path no longer exists.

   • Hard links must stay within the same filesystem and normally cannot point to directories.
   • Symbolic links can cross filesystems and point to files or directories.
   • Symbolic links have their own inodes and can point to paths that do not exist.
   • Use ln for hard links and ln -s for symbolic links.

   What the interviewer checks: The interviewer is checking whether you understand file names, inodes, and what happens when a link or target is removed.

   Other ways it was asked

   • “Explain symbolic links versus hard links.”
   • “What is the difference between a hard link and a soft link in Linux?”

5. How do you create a directory from the Linux command line?

   Asked in 3 of 94 interviews · last asked Oct 7 · Tooling · Junior

   Show answer

   Use `mkdir` followed by the directory name. For example, `mkdir test` creates a directory named `test` in the current directory. Use `mkdir -p parent/child` to create missing parent directories too.

   • You need write and execute permissions on the parent directory.
   • Quote names that contain spaces, such as `mkdir "my folder"`.
   • With `-p`, an existing directory does not cause an error.
   • To rename a directory, use `mv old_name new_name`, where `new_name` does not already exist.

   CodeCopy

   mkdir test

   What the interviewer checks: The interviewer checks whether you can use mkdir and understand directory paths and basic permissions.

   Other ways it was asked

   • “How do you create a folder in Linux?”
   • “How do you rename a folder in Linux?”
   • “What command would you use to create a directory?”

6. Which Linux commands do you commonly use for system administration, and what does each do?

   Asked in 3 of 94 interviews · last asked Sep 19 · Tooling · Junior

   Show answer

   I use `ps` and `top` to check processes and resource use. `df` shows filesystem space, while `du` shows space used by files and directories. On systemd systems, `systemctl` manages services and `journalctl` reads logs. I use `ip` to check network settings and `ss` to inspect sockets.

   • `free` shows memory and swap use; available memory matters more than free memory alone.
   • `chmod` changes file permissions; `chown` changes file owners and groups.
   • `kill` sends signals to processes; try normal termination before forcing a process to stop.
   • `sudo` runs commands as another user, usually root, when permitted.

   What the interviewer checks: The interviewer checks whether you can choose the right commands for routine administration and basic troubleshooting.

   Other ways it was asked

   • “Which Linux commands do you use most often, and what tasks do you use them for?”
   • “What are some commonly used Linux commands, and what does each do?”
   • “Which Linux commands are commonly used for system administration?”

7. How do you use df to check filesystem disk usage in Linux?

   Asked in 3 of 94 interviews · last asked May 13 · Tooling · Junior

   Show answer

   Use `df -h` to check disk space on mounted filesystems in easy-to-read units, such as GiB. It shows total space, used space, available space, usage percentage, and mount point. Use `df -h /path` to check the filesystem containing a specific file or directory.

   • `-h` displays sizes in human-readable units using powers of 1024.
   • `df` reports filesystem usage; `du` reports file and directory usage.
   • `df -i` checks inode usage, which can reach its limit even when disk space remains.

   CodeCopy

   df -h
   # Check the filesystem containing /var:
   df -h /var

   What the interviewer checks: The interviewer is checking whether you can read filesystem capacity and distinguish it from directory size.

   Other ways it was asked

   • “How do you check how much disk space is being used in Linux?”
   • “What command would you use in Linux to check disk space?”
   • “What does the df command do in Linux?”

8. What is the difference between kill and kill -9, and what does SIGKILL do?

   Asked in 3 of 94 interviews · last asked Aug 30 · Concept · Junior

   Show answer

   By default, `kill PID` sends SIGTERM, which asks a process to stop and lets it handle the signal for cleanup. `kill -9 PID` sends SIGKILL, which forces termination without letting the process run cleanup code. SIGKILL cannot be caught, blocked, or ignored.

   • Try SIGTERM first; use SIGKILL if the process does not stop.
   • SIGTERM can be caught, blocked, or ignored.
   • SIGKILL may leave unfinished writes or temporary files behind.
   • A process in uninterruptible sleep may not exit until that state ends, even after SIGKILL.

   What the interviewer checks: The interviewer checks whether you understand graceful termination, forced termination, and when to use each signal.

   Other ways it was asked

   • “What is the difference between `kill -9` and `kill` in Linux?”
   • “What is the difference between `kill` and `kill -9`?”
   • “What happens when you run `kill -9 1234`?”

9. What are Linux services, and how do you manage them using systemd and systemctl?

   Asked in 3 of 94 interviews · last asked Sep 19 · Tooling · Junior

   Show answer

   Linux services are background programs that handle tasks such as logging or serving web requests. On systems that use systemd, it manages services and their dependencies through unit files. Use systemctl to start, stop, restart, or check services, and to enable or disable automatic startup.

   • systemd is the service manager; systemctl is the command used to control it.
   • Starting runs a service now; enabling configures automatic startup, usually at boot.
   • Disabling does not stop a running service; use --now to do both.
   • Use systemctl status to check state and journalctl -u to read service logs.

   CodeCopy

   # Replace example.service with an installed service name.
   sudo systemctl start example.service
   sudo systemctl stop example.service
   sudo systemctl restart example.service
   systemctl status example.service
   sudo systemctl enable --now example.service
   sudo systemctl disable --now example.service
   sudo journalctl -u example.service

   What the interviewer checks: The interviewer checks whether you can manage services and distinguish their current state from their startup settings.

   Other ways it was asked

   • “How do you manage services in Ubuntu, including starting and stopping them?”
   • “Explain systemd and systemctl.”
   • “What are Linux services, and how do you manage them?”

10. Describe a PowerShell or Bash script you would use to automate an administrative task.

    Asked in 3 of 94 interviews · last asked Sep 3 · Tooling · Mid-level

    Show answer

    I would use Bash to back up system configuration files in /etc. The script creates a dated archive, restricts access, and stops if a command fails. I would schedule it with cron, monitor failures, and test that files can be restored.

    • Run with permission to read the source files and write the backup.
    • Restrict backup access because configuration files may contain secrets.
    • Schedule regular runs and alert on failures.
    • Keep older backups under a retention policy and test restores.

    CodeCopy

    #!/bin/bash
    set -euo pipefail
    umask 077
    backup_dir=/var/backups/etc
    mkdir -p "$backup_dir"
    archive="$backup_dir/etc-$(date +%Y%m%d-%H%M%S).tar.gz"
    tar -czf "$archive" -C / etc
    printf 'Backup saved: %s\n' "$archive"

    What the interviewer checks: The interviewer is checking whether you can automate a useful task while handling permissions, failures, and scheduling.

    Other ways it was asked

    • “Do you have experience using PowerShell or Bash? Can you describe a script or command-line task you have used for troubleshooting or basic automation?”
    • “How would you use PowerShell or Bash to automate a task?”
    • “Can you share an example of a productivity automation or PowerShell script you built?”

11. How do cron jobs work, when would you use them, and what do crontab fields mean?

    Asked in 3 of 94 interviews · last asked Sep 28 · Concept · Mid-level

    Show answer

    Cron is a service that runs commands automatically on a repeating schedule. I use it for backups, cleanup, and regular reports. A user crontab has five time fields: minute, hour, day of month, month, and day of week, followed by the command. An asterisk means every allowed value.

    • Ranges: minute 0–59, hour 0–23, day of month 1–31, and month 1–12.
    • On Linux, weekdays usually range from 0–7; both 0 and 7 mean Sunday.
    • System crontabs, such as /etc/crontab, add a username field before the command.
    • Cron has a limited environment, so use absolute paths and set required environment variables.

    CodeCopy

    # Edit your user crontab with: crontab -e
    # Run an existing backup script every day at 02:00.
    0 2 * * * /usr/local/bin/backup.sh

    What the interviewer checks: The interviewer is checking whether you can choose suitable recurring tasks and read or write a cron schedule.

    Other ways it was asked

    • “When would you use cron jobs to schedule tasks?”
    • “What is cron, and what are the values in the crontab?”
    • “What are cron jobs, and when would you use them?”

12. How would you troubleshoot a slow Linux server, and which commands would you use?

    Asked in 3 of 94 interviews · last asked Aug 14 · Scenario · Mid-level

    Show answer

    I first confirm what is slow and check recent changes. I use `uptime`, `top`, `free -h`, and `vmstat 1` to check load, CPU, memory, and swapping. I check storage with `df -h` and `iostat -xz 1`, connections with `ss -s`, and logs with `journalctl`. I fix the cause, then measure again.

    • High load can mean CPU demand or tasks waiting for I/O; it does not prove CPU overload.
    • Check available memory and ongoing swap activity; low free memory alone is normal because Linux caches data.
    • Check disk space, inodes with `df -i`, and I/O latency; `iostat` comes from the sysstat package.
    • Check application logs and slow dependencies, such as databases or network services, before changing settings or restarting.

    What the interviewer checks: The interviewer checks whether you use evidence to find the bottleneck and verify that your fix works.

    Other ways it was asked

    • “Your Linux computer is running more slowly than usual. Walk me through how you would troubleshoot and potentially fix it.”
    • “What Linux commands would you use to diagnose performance problems on a server?”
    • “How would you debug a slow Linux server hosting an application?”

13. How do you check used and available RAM from the Linux command line?

    Asked in 3 of 94 interviews · last asked Oct 7 · Tooling · Junior

    Show answer

    Use `free -h` to show used, free, and available RAM in readable units. The `available` column estimates how much RAM applications can use without swapping. The `free` column shows unused RAM; it excludes memory used for caches that Linux may reclaim.

    • Read the Mem row for RAM; the Swap row is separate.
    • Use available, not just free, to judge remaining memory capacity.
    • `/proc/meminfo` provides detailed memory values in KiB, labeled kB.

    CodeCopy

    free -h
    # Print only unused RAM, in KiB:
    awk '/^MemFree:/ {print $2}' /proc/meminfo
    # Print only available RAM, in KiB:
    awk '/^MemAvailable:/ {print $2}' /proc/meminfo

    What the interviewer checks: The interviewer checks whether you can inspect RAM usage and explain the difference between free and available memory.

    Other ways it was asked

    • “How would you display the amount of memory currently free on your system?”
    • “How would you display only the value of the memory currently free on your system?”
    • “How can you check current RAM usage on a Linux machine?”

14. How would you print log lines containing errors or warnings?

    Asked in 2 of 94 interviews · last asked Oct 7 · Tooling · Junior

    Show answer

    I would use `grep -Ei 'error|warn' test.log` to print lines containing errors or warnings. `-E` enables `|` to mean “or,” and `-i` ignores letter case.

    • This prints whole matching lines, not just the matched words.
    • The pattern matches ERROR, WARN, WARNING, and any text containing those strings.
    • For errors only, use `grep -i 'error' test.log`.

    CodeCopy

    grep -Ei 'error|warn' test.log

    What the interviewer checks: The interviewer is checking whether you can filter logs using grep, multiple patterns, and case-insensitive matching.

    Other ways it was asked

    • “How would you print only the warning and error messages from logs?”
    • “How would you print the lines containing "error" in test.log?”

15. How do you create a file from the Linux command line?

    Asked in 2 of 94 interviews · last asked Oct 7 · Tooling · Junior

    Show answer

    Use `touch test.log` to create an empty file named `test.log`. If the file already exists, `touch` updates its timestamps without changing its contents. To create a file with text, use `printf` with output redirection (`>`).

    • `touch` creates a file only if it does not already exist.
    • `>` creates a file or overwrites its existing contents.
    • `>>` appends text, creating the file if needed.

    CodeCopy

    touch test.log

    What the interviewer checks: The interviewer checks whether you can create a file and understand which commands may overwrite existing contents.

    Other ways it was asked

    • “Can you create a file named test.log?”

16. How do you list files and directories in Linux, including hidden files?

    Asked in 2 of 94 interviews · last asked Sep 19 · Tooling · Junior

    Show answer

    Use `ls` to list files and directories. Use `ls -a` to include hidden entries, whose names start with a dot. Use `ls -la` to also show details such as permissions, owner, and size.

    • `ls` lists the current directory by default; provide a path to list another directory.
    • `-a` includes hidden entries plus `.` and `..`.
    • `-A` includes hidden entries but leaves out `.` and `..`.

    CodeCopy

    ls -la /etc

    What the interviewer checks: The interviewer is checking whether you know the basic listing command and how to show hidden entries.

    Other ways it was asked

    • “How do you list files in Linux, including hidden files?”
    • “What command would you use to list files and directories?”

17. What do su and sudo do in Linux, and when would you use each?

    Asked in 2 of 94 interviews · last asked Oct 7 · Concept · Junior

    Show answer

    su starts a shell as another user, usually root. Use it when you need a session as that user. sudo runs an allowed command as another user, usually root. Use it for admin tasks with permissions controlled by policy, without sharing the root password.

    • su normally asks for the target user's password; root can usually switch without one.
    • sudo normally asks for your own password, but policy can allow commands without a password.
    • su - starts a login shell with the target user's environment.
    • sudo controls access through policy, usually logs commands, and can also allow shells with sudo -i.

    What the interviewer checks: The interviewer checks whether you understand user switching, controlled admin access, and whose password each command normally needs.

    Other ways it was asked

    • “What does the sudo command do?”
    • “What are su and sudo in Linux, and how are they used?”

18. What do Linux file permissions 755 and 644 mean?

    Asked in 2 of 94 interviews · last asked Oct 7 · Concept · Junior

    Show answer

    755 gives the owner read, write, and execute permissions; the group and others get read and execute. 644 gives the owner read and write permissions; the group and others get read only. The three digits describe permissions for the owner, group, and others, in that order.

    • Each digit adds permission values: read = 4, write = 2, execute = 1.
    • 755 is common for directories and executable files; 644 is common for regular, non-executable files.
    • For directories, read lists entry names; execute allows traversal and access to entries.

    What the interviewer checks: The interviewer is checking whether you can read numeric permissions and explain who can access a file.

    Other ways it was asked

    • “What do file permissions 755 and 644 mean?”
    • “What does chmod 755 mean?”

19. What steps would you take to harden a Linux server?

    Asked in 2 of 94 interviews · last asked Oct 8 · Scenario · Mid-level

    Show answer

    I would update the system, remove unused software, and disable services the server does not need. I would restrict firewall access, use SSH keys, disable direct root login, and limit sudo rights. I would keep SELinux or AppArmor enabled, protect sensitive files, and monitor logs. Finally, I would test backups and review security settings regularly.

    • Allow only required ports, and restrict administrative access to trusted networks.
    • Test SSH key access before disabling password login to avoid locking yourself out.
    • Give users and services only the permissions they need.
    • Apply security updates regularly and test that backups can be restored.

    What the interviewer checks: The interviewer is checking whether you can reduce attack paths without breaking services or losing access.

    Other ways it was asked

    • “How do you secure a Linux server?”
    • “What Linux hardening measures would you recommend?”

20. What is the difference between the `df` and `du` commands, and what does each show?

    Asked in 2 of 94 interviews · last asked Aug 14 · Concept · Junior

    Show answer

    `df` shows total, used, and available space on mounted file systems. `du` shows disk space used by files and directories by scanning their contents. The `-h` option makes sizes easier to read, using units like K, M, and G.

    • `df` reports file system space; `du` measures usage under a file or directory path.
    • `du -sh /path` shows one total for that path.
    • Results can differ: deleted files still held open use space in `df` but are not found by `du`.

    CodeCopy

    df -h /
    du -sh /var/log

    What the interviewer checks: The interviewer checks whether you can distinguish file system capacity from file and directory usage.

    Other ways it was asked

    • “What’s the difference between `df -h` and `du -h`?”

Related interview questions

• System Administrator interview questions
• DevOps Engineer interview questions
• Software Engineer interview questions
• Cybersecurity interview questions
• IT Support and Help Desk interview questions
• Network Engineer interview questions
• AWS interview questions
• Azure interview questions
• Docker interview questions
• Kubernetes interview questions
• Terraform interview questions
• CI/CD interview questions
• Active Directory and Windows Server interview questions

How this list is made

Every question here was asked by a real interviewer in a real job interview that a candidate ran MeetAssist in. After the call, the interviewer's questions are pulled from the transcript. Practice sessions, tests, exams and anything that was not a job interview are dropped.

Questions are rewritten so they make sense on their own: names of people, employers and clients are removed, and speech-to-text mistakes are fixed. Small talk, logistics and questions about one candidate's own résumé are left out. Rephrasings of the same question are merged, and the count is the number of different interviews it came up in.

The interviews come from candidates who use MeetAssist, so they lean towards software, data and AI roles: the shares describe these interviews, not every Linux interview. Answers to the most asked questions are written and checked by an editor; a "common mistake" is shown only when reviews of real answers in these interviews show it, with the count.

94 interviews, 67 candidates, Nov 2025 to Oct 2026. Updated every month with new interviews.