Question 1

What is Linux, and why is it widely used in servers and DevOps environments?

Accepted Answer

Linux is an open-source operating system kernel that powers many server distributions such as Ubuntu, Debian, Rocky Linux, and Red Hat Enterprise Linux. It is widely used in DevOps because it is stable, scriptable, efficient, and gives administrators strong control over networking, processes, permissions, and automation.

In practice, Linux is popular because most cloud infrastructure, containers, and CI/CD tooling are designed with Linux in mind. A good interview answer should connect Linux to real operations work: managing services, automating with shell scripts, debugging system issues, and running applications reliably in production.

Question 2

How do you navigate the Linux filesystem and inspect files from the command line?

Accepted Answer

Common commands include `pwd` to show your current directory, `ls -lah` to list files with details, `cd` to change directories, `cat` to print a file, `less` to read large files page by page, and `head` or `tail` to inspect the beginning or end of a file.

In an interview, it helps to explain when you would use each one. For example, `less` is better than `cat` for large log files because it is easier to search and scroll. `tail -f` is especially useful for following logs in real time during troubleshooting.

Question 3

What is the difference between an absolute path and a relative path?

Accepted Answer

An absolute path starts from the root directory, such as `/var/log/syslog`, and always points to the same location regardless of where you are currently working. A relative path depends on your current directory, such as `../logs/app.log`.

This matters in scripting and automation because absolute paths are usually safer for cron jobs, systemd services, and deployment scripts. Relative paths can fail if the working directory is not what you expected.

Question 4

What does `chmod 755` mean?

Accepted Answer

`chmod 755` sets permissions using numeric notation. The owner gets `7`, which means read, write, and execute. The group gets `5`, which means read and execute. Others also get `5`, which means read and execute.

This is commonly used for directories and executable scripts. On a directory, execute means users can enter the directory. A strong answer also mentions that overly broad permissions can create security risks, so permissions should follow least privilege rather than using `777` by default.

Question 5

What is the difference between a user, a group, and file ownership in Linux?

Accepted Answer

A user is an account that can log in or run processes. A group is a collection of users that share permissions. Every file and directory has an owner user and an owner group, and Linux checks these along with the permission bits to decide who can read, write, or execute something.

This model is important because it lets administrators grant shared access without giving everyone full control. For example, a deployment directory might be owned by `root`, assigned to a `deploy` group, and configured so only approved users in that group can update application files.

Question 6

What is the difference between a hard link and a symbolic link?

Accepted Answer

A hard link points to the same inode as the original file, so both names refer to the same underlying data on disk. A symbolic link, or symlink, stores a path that points to another file or directory.

Hard links usually cannot cross filesystems and typically do not work for directories in normal administration. Symlinks are more flexible and are common in configuration management, releases, and shared paths such as `/etc/nginx/sites-enabled`. If the original file is deleted, a hard link can still access the data, but a symlink becomes broken if its target no longer exists.

Question 7

How do you find the top CPU-consuming processes in Linux?

Accepted Answer

For live monitoring, `top` or `htop` are the most common tools. For a quick snapshot, `ps aux --sort=-%cpu | head` shows the highest CPU consumers at that moment.

In a real troubleshooting flow, CPU usage alone is not enough. You should also check whether the process is expected, whether the spike is temporary or sustained, and whether high CPU is caused by application load, a runaway loop, or system pressure such as excessive context switching.

Question 8

How do you inspect memory usage on a Linux server?

Accepted Answer

Useful commands include `free -h` for a quick memory summary, `top` or `htop` for process-level usage, and `ps aux --sort=-%mem | head` to find the biggest memory consumers.

It is also important to interpret memory correctly. Linux uses free memory for buffers and cache to improve performance, so low "free" memory alone does not always indicate a problem. A better answer looks at available memory, swap activity, and whether the system is actively reclaiming memory or killing processes with the OOM killer.

Question 9

How do you check disk space and identify what is consuming it?

Accepted Answer

`df -h` shows filesystem usage, while `du -sh /path/*` helps identify large directories. If you need to go deeper, you can use `du -ah` and sort the output to find large files.

In production, the important part is not just freeing space quickly but doing it safely. You should verify whether the growth is from logs, backups, temporary files, or application data. Deleting files blindly can break an application or remove data needed for compliance or recovery.

Question 10

What is the purpose of `/etc/fstab`?

Accepted Answer

`/etc/fstab` defines filesystems that should be mounted automatically, along with their mount points, filesystem types, mount options, and boot-time check order.

An interview-quality answer should mention caution: a bad `fstab` entry can cause boot issues. After making changes, administrators often validate with `mount -a` to catch syntax or configuration mistakes before the next reboot.

Question 11

How do you identify open ports and listening services on a Linux host?

Accepted Answer

`ss -tulpen` is one of the best commands for showing listening TCP and UDP sockets along with process information. `lsof -i -P -n` is also useful for correlating sockets to processes.

This question often leads into troubleshooting. If an application is unreachable, you want to confirm whether the service is actually listening, whether it is bound to the correct interface, and whether a firewall, security group, or reverse proxy is blocking access.

Question 12

What is systemd, and how do you troubleshoot a failed service?

Accepted Answer

`systemd` is the service manager used by many modern Linux distributions. It handles starting, stopping, restarting, and supervising services, as well as boot targets, timers, and dependencies. To troubleshoot a failed service, I would usually start with `systemctl status ` to see the current state, exit code, and recent logs. Then I would use `journalctl -u -xe` or `journalctl -u --since "30 minutes ago"` to review more detailed logs. From there, I would check the unit file, environment variables, permissions, ports, and any missing dependencies.

Question 13

What is load average, and how do you interpret it?

Accepted Answer

Load average shows how many tasks are runnable or waiting in uninterruptible sleep over the last 1, 5, and 15 minutes. It is a measure of system demand, not just CPU usage.

The number should be interpreted relative to CPU core count. For example, a load average of 4 on a 4-core machine may be acceptable, while the same load on a 1-core system suggests contention. It is also useful to remember that blocked disk I/O can increase load average even when CPU usage is not high.

Question 14

What is the difference between a process and a thread?

Accepted Answer

A process is an independent running program with its own memory space and resources. A thread is a smaller execution unit inside a process, and multiple threads in the same process share the same memory.

This distinction matters when troubleshooting performance and stability. A multi-threaded application may show one process with many active threads. Threads are lighter than processes, but they can also create concurrency issues such as deadlocks, race conditions, or uneven CPU utilization.

Question 15

How do you safely stop or terminate a process in Linux?

Accepted Answer

The preferred approach is to identify the process with `ps`, `pgrep`, or `top`, then send a graceful signal such as `kill -15 ` which is `SIGTERM`. This allows the application to clean up resources, close files, and shut down properly. If the process does not respond, `kill -9 ` sends `SIGKILL`, which forces termination immediately. That is effective but more disruptive, so it should be used carefully because it can leave temporary files, partial writes, or inconsistent application state behind.

Question 16

What is the difference between `grep`, `awk`, and `sed`?

Accepted Answer

`grep` is mainly used for searching text patterns. `awk` is powerful for field-based processing and reporting. `sed` is commonly used for stream editing, such as substitutions and simple text transformations.

In administration work, these tools are often combined. For example, `grep` can filter relevant log lines, `awk` can extract specific columns, and `sed` can rewrite output for cleanup or automation. An interview answer is stronger if it shows you understand not just definitions but where each tool fits in day-to-day troubleshooting.

Question 17

How do you investigate why a Linux server became slow?

Accepted Answer

I would start by checking CPU, memory, disk, and load using tools like `top`, `htop`, `free -h`, `vmstat`, `iostat`, and `df -h`. Then I would review logs, recent deployments, cron jobs, backups, and any unusual spikes in traffic or errors.

The key is to narrow the bottleneck instead of guessing. High CPU suggests compute pressure, heavy swap usage points to memory pressure, and high disk wait indicates storage issues. Slow systems can also be caused by DNS problems, exhausted file descriptors, a noisy neighbor in virtualized environments, or a failing dependency rather than the host itself.

Question 18

What is swap, and when is it useful or harmful?

Accepted Answer

Swap is disk space used as an extension of RAM when physical memory becomes constrained. It can help prevent immediate crashes by giving the kernel more room to move less active memory pages out of RAM.

However, swap is much slower than memory, so heavy swapping can make a server feel unresponsive. In interviews, a good answer explains that some swap can be useful as a buffer, but constant swap activity usually signals a memory sizing problem, a leak, or a workload that needs tuning.

Question 19

What is the difference between `cron` and `systemd` timers?

Accepted Answer

`cron` is the traditional scheduler for recurring tasks using time-based expressions. `systemd` timers provide a newer scheduling model integrated with `systemd` services.

`systemd` timers are often preferred on modern systems because they integrate better with logging, dependencies, environment handling, and service supervision. `cron` is still widely used and simple for basic schedules, but `systemd` timers give more operational visibility and control.

Question 20

How do you troubleshoot a service that starts successfully but is still unreachable from another machine?

Accepted Answer

First, verify the service is listening on the expected port with `ss -tulpen` or `netstat` if available. Then confirm whether it is bound to `127.0.0.1` only or to an external interface such as `0.0.0.0`. After that, check host firewall rules with tools like `ufw`, `firewalld`, or `iptables`, and also verify upstream network controls such as cloud security groups or load balancer rules.

It is also worth validating DNS resolution, reverse proxy configuration, TLS termination, and application-level access controls. Many times the service itself is healthy, but traffic is being blocked, routed incorrectly, or rejected before it reaches the application.

Question 21

What does the OOM killer do in Linux?

Accepted Answer

The OOM killer, or out-of-memory killer, is the kernel mechanism that terminates processes when the system runs out of memory and cannot recover safely. Its goal is to keep the system alive by selecting one or more processes to kill.

In troubleshooting, you would check `dmesg`, `journalctl`, or kernel logs for OOM events. A strong answer also mentions that the real fix is usually not "restart the app" but understanding why memory was exhausted, such as a leak, a traffic spike, bad limits, or an undersized machine.

Question 22

How do you diagnose high disk I/O wait on a Linux server?

Accepted Answer

I would look at `iostat`, `vmstat`, `top`, and application logs to confirm whether the system is spending time waiting on storage. Then I would identify which processes are reading or writing heavily, whether disks are near capacity, and whether the issue is local storage, network-attached storage, or burst-credit exhaustion in the cloud.

High I/O wait can come from large backups, excessive logging, database checkpoints, queue backlogs, or fragmented operational patterns such as repeatedly scanning very large directories. The answer should show that you understand performance is not only about CPU and RAM; storage latency can dominate the user experience.

Question 23

What steps would you take after editing a critical system configuration file in production?

Accepted Answer

I would first validate the syntax if a validation command exists, create a backup or ensure the file is version controlled, and apply the change in the smallest safe way possible. After reloading or restarting the related service, I would immediately verify service health, logs, and user impact.

For example, after editing `nginx.conf`, I would run `nginx -t` before reloading. After changing `/etc/fstab`, I would test with `mount -a`. The larger point is that production administration should be deliberate: validate, apply safely, verify, and have a rollback plan ready.

Question 24

What is the difference between `systemctl restart` and `systemctl reload`?

Accepted Answer

`restart` stops and starts the service again, while `reload` asks the service to re-read configuration without a full restart if the service supports it.

This matters because reload can reduce disruption, but not every service implements it. Good administrators know when a full restart is actually required.

Question 25

What is a file descriptor in Linux?

Accepted Answer

A file descriptor is a numeric handle the operating system uses to represent open files, sockets, pipes, and similar resources for a process.

This becomes important in troubleshooting because services can fail when they exhaust open file limits. It is a common advanced operational issue.

Question 26

How do you check inode usage?

Accepted Answer

You can use `df -i` to inspect inode usage on filesystems.

This is important because a filesystem can run out of inodes even when it still has free disk space left. Large numbers of tiny files often cause this issue.

Question 27

What is the purpose of `journalctl`?

Accepted Answer

`journalctl` is used to query and view logs collected by the `systemd` journal.

It is very useful because it centralizes logs from services, the kernel, and boot events. Strong answers mention filtering by unit, time, or priority during debugging.

Question 28

How do you troubleshoot a permissions issue on Linux?

Accepted Answer

I would check file ownership, permission bits, parent directory permissions, group membership, effective user context, and any additional controls like ACLs or SELinux.

Permissions problems are often more than a simple `chmod` issue. A structured check avoids blindly loosening access and creating security problems.

Question 29

What is the difference between a reboot and a service restart in troubleshooting?

Accepted Answer

A reboot restarts the entire host, while a service restart affects only one service.

Good administrators avoid unnecessary reboots because they are more disruptive and can hide the root cause instead of solving it. Targeted fixes are usually safer and more informative.

Question 30

What is SELinux or AppArmor at a high level?

Accepted Answer

SELinux and AppArmor are mandatory access control systems that add security rules beyond traditional Unix permissions.

They can prevent services from accessing resources even when file permissions look correct. Mentioning them shows awareness of deeper Linux security and troubleshooting layers.

Linux & System Administration

1. What is Linux, and why is it widely used in servers and DevOps environments?

2. How do you navigate the Linux filesystem and inspect files from the command line?

3. What is the difference between an absolute path and a relative path?

4. What does `chmod 755` mean?

5. What is the difference between a user, a group, and file ownership in Linux?

6. What is the difference between a hard link and a symbolic link?

7. How do you find the top CPU-consuming processes in Linux?

8. How do you inspect memory usage on a Linux server?

9. How do you check disk space and identify what is consuming it?

10. What is the purpose of `/etc/fstab`?

11. How do you identify open ports and listening services on a Linux host?

12. What is systemd, and how do you troubleshoot a failed service?

13. What is load average, and how do you interpret it?

14. What is the difference between a process and a thread?

15. How do you safely stop or terminate a process in Linux?

16. What is the difference between `grep`, `awk`, and `sed`?

17. How do you investigate why a Linux server became slow?

18. What is swap, and when is it useful or harmful?

19. What is the difference between `cron` and `systemd` timers?

20. How do you troubleshoot a service that starts successfully but is still unreachable from another machine?

21. What does the OOM killer do in Linux?

22. How do you diagnose high disk I/O wait on a Linux server?

23. What steps would you take after editing a critical system configuration file in production?

24. What is the difference between `systemctl restart` and `systemctl reload`?

25. What is a file descriptor in Linux?

26. How do you check inode usage?

27. What is the purpose of `journalctl`?

28. How do you troubleshoot a permissions issue on Linux?

29. What is the difference between a reboot and a service restart in troubleshooting?

30. What is SELinux or AppArmor at a high level?