Preparing for a Linux interview can vary wildly depending on whether you are looking at an entry-level helpdesk role, a DevOps position, or a senior Systems Administrator gig.

To give you the best foundation, here is a breakdown of the most frequently asked Linux interview questions, categorized by difficulty and topic.

1. Fundamentals & Concept Questions

Q: What is the difference between a Hard Link and a Soft (Symbolic) Link?

• Hard Link: A hard link is a direct pointer to the physical data (the inode) on the disk. If you delete the original file, the hard link still works and can access the data. They cannot cross different filesystems or point to directories.
• Soft Link: Essentially a shortcut. It points to the file name rather than the underlying inode. If you delete the original file, the soft link becomes “broken” (dangling). They can cross filesystems and point to directories.

Q: Can you explain the Linux Boot Sequence?

Interviewers love this because it proves you know how the OS operates under the hood. The core steps are:

1. BIOS/UEFI: Performs POST (Power-On Self-Test) and loads the MBR/EFI boot sector.
2. GRUB (Bootloader): Allows you to select the kernel and loads it into memory.
3. Kernel: Initializes hardware and mounts the root filesystem (/).
4. systemd / Init: The primary process (PID 1) starts up, managing system services, targets, and daemons.

Q: What is an Inode, and what happens if a disk runs out of them?

An inode (index node) is a data structure that stores metadata about a file (size, owner, permissions, location on disk), but not the file name or actual data.

Interview Tip: If a system runs out of inodes (which you check via df -i), you cannot create new files, even if df -h shows you have gigabytes of free disk space.

2. Practical Troubleshooting Scenario Questions

Q: “The server is running incredibly slow. What are the first three commands you run?”

This tests your live triage methodology. A great baseline answer is:

• top (or htop): To instantly see CPU/Memory usage and identify rogue, resource-heavy processes.
• free -m: To check if the system is running out of physical RAM and aggressively using Swap space, which destroys performance.
• uptime: To look at the system load averages over the last 1, 5, and 15 minutes.

Q: “An application can’t bind to its port, or users can’t connect. How do you troubleshoot?”

1. Check if the service is actually running and listening: ss -tulpn or netstat -tulnp.
2. Check for local firewall restrictions: iptables -L or ufw status / firewall-cmd --list-all.
3. Check security enforcement modules like SELinux or AppArmor: run getenforce to see if it’s blocking the application.

Q: “How do you securely check logs for a specific service failing in systemd?”

Instead of digging around blindly in /var/log/, use:

Bash

journalctl -u nginx.service -n 50 --no-pager

(Replacing nginx.service with the failing service. -n 50 pulls the last 50 lines).

3. High-Frequency Commands Cheat Sheet

Be ready to explain or write out these daily-use commands:

4. Advanced / DevOps Linux Questions

Q: What is the difference between a Process and a Thread in Linux?

In Linux, the kernel doesn’t strictly differentiate between them the way other operating systems do. Both are represented by task_struct. However:

• A Process gets its own isolated memory space.
• A Thread is a lightweight unit of execution created inside a process that shares the parent process’s memory, file descriptors, and environment.

Q: What is Zombie Process, and how do you kill it?

A zombie process is a process that has completed execution but still has an entry in the process table because its parent process hasn’t read its exit status yet (via wait()).

The Catch: You cannot kill a zombie process using kill -9 PID because it is already technically dead. To get rid of it, you must either kill its parent process or restart the service owning it.