Linux interview questions and answers

1. What set -euo pipefail does

Many CI scripts start with set -euo pipefail. What does this line do?

#!/usr/bin/env bash
set -euo pipefail
./build.sh | tee build.log
echo "Deploying $TARGET"

1. A.Exit on any failing command, error on unset variables, and fail a pipeline if any part fails.
2. B.Print each command before it runs, run independent steps in parallel, and ignore errors inside pipes.
3. C.Enable extended globbing, export every variable, and retry each failed command once.
4. D.Run the script as root, turn off shell history, and send all of its output to syslog.

2. Safer Bash scripts

What does putting set -euo pipefail at the top of a Bash automation script do?

1. A.It makes the script run faster by using all CPU cores
2. B.It makes the script exit on errors, on unset variables, and when any command in a pipeline fails
3. C.It hides all output from the script
4. D.It makes the script run as root

3. Hard link after deleting the original

You create a hard link and a symbolic link to report.txt, then delete report.txt. What happens when you open each link?

ln report.txt hard.txt
ln -s report.txt soft.txt
rm report.txt

1. A.Both links still open the data normally
2. B.Both links are now broken and return an error
3. C.soft.txt still opens the data; hard.txt is broken
4. D.hard.txt still opens the data; soft.txt is now broken

4. The t at the end of /tmp

ls -ld /tmp shows drwxrwxrwt. What does the final "t" (the sticky bit) do on this directory?

1. A.Files in it are kept in RAM instead of on disk
2. B.Files in it are deleted automatically at every reboot
3. C.Users can delete or rename only their own files in it
4. D.New files in it inherit the group of the directory

5. Mode of a new file with umask 022

Your shell has umask 022. You run "touch notes.txt". What permissions does the new file get?

1. A.755 (rwxr-xr-x)
2. B.666 (rw-rw-rw-)
3. C.600 (rw-------)
4. D.644 (rw-r--r--)

6. Signal sent by plain kill

You run "kill 4321" without naming a signal. Which signal does the process receive?

1. A.SIGTERM (15), a polite request to exit
2. B.SIGKILL (9), which ends it at once
3. C.SIGHUP (1), which reloads its configuration
4. D.SIGINT (2), the same as pressing Ctrl+C

7. Files changed in the last 24 hours

Which command lists regular files under /etc whose content changed in the last 24 hours?

1. A.find /etc -type f -mtime -1
2. B.find /etc -type f -mtime +1
3. C.find /etc -type f -atime 1
4. D.find /etc -type f -newer 1

8. Meaning of exit status 0

After a command finishes, echo $? prints 0. What does that tell you?

1. A.The command produced no output
2. B.The command was killed by a signal
3. C.The command reported success
4. D.The command has not finished yet

9. The wa figure in top

In the %Cpu(s) line of top, what does a high "wa" value show?

1. A.CPUs sitting idle while tasks wait for disk I/O
2. B.Time spent running processes in user space
3. C.Time the kernel spent handling network packets
4. D.Time stolen by the hypervisor for other VMs

10. How many CPUs this box has

You need the number of CPUs available to the current process, for example to set the worker count. Which command prints just that number?

1. A.uptime
2. B.uname -m
3. C.nproc
4. D.free -c

11. Which kernel is running

After installing a kernel update, how do you confirm which kernel version is actually running right now?

1. A.cat /etc/hostname
2. B.uname -r
3. C.lsb_release -c
4. D.ls /boot | tail -1

12. Enable versus start

You install nginx and run "systemctl enable nginx". After that, is nginx running?

1. A.Not yet; enable only sets it to start at boot
2. B.Yes; enable starts it now and at every boot
3. C.Yes, but it stops again when you log out
4. D.No; enable only checks the unit for errors

13. Listing units that failed

After a reboot you want a quick list of every unit that failed to start. Which command gives it?

1. A.systemctl list-timers
2. B.systemctl --failed
3. C.systemctl get-default
4. D.systemctl show-environment

14. Package tool on RHEL and Ubuntu

Which pairing of distribution and default package tool is correct?

1. A.Ubuntu uses apt; RHEL 9 uses dnf
2. B.Ubuntu uses dnf; RHEL 9 uses apt
3. C.Ubuntu uses pacman; RHEL 9 uses zypper
4. D.Both use snap as the main package tool

15. Seeing the server's IP addresses

ifconfig is not installed on a new server. Which command shows each network interface and its IP addresses?

1. A.ip route show
2. B.ss -tln
3. C.ip addr show
4. D.cat /etc/resolv.conf

16. Setting up key login to a server

You made a key pair with ssh-keygen. What does "ssh-copy-id user@server" do?

1. A.Copies your private key to the server for backup
2. B.Appends your public key to the server's authorized_keys
3. C.Copies the server's host key into your known_hosts
4. D.Creates a new user account named after your key

17. Seeing a newly attached disk

You attached a new 100 GB volume to a VM. Which command lists block devices with sizes and mount points so you can find it?

1. A.lsblk
2. B.lsmod
3. C.lspci -k
4. D.lsof -d

18. Checking only the response headers

You want to see the status code and headers a URL returns, without downloading the body. Which command fits?

1. A.curl -O https://example.com
2. B.curl -I https://example.com
3. C.curl -d x https://example.com
4. D.curl -o /tmp https://example.com

19. File names with spaces in a script

file="Q3 report.pdf" and the script runs rm $file. What happens?

1. A.rm deletes "Q3 report.pdf" correctly
2. B.Bash refuses to run rm with a space in it
3. C.rm deletes every PDF file in the folder
4. D.rm tries to delete two files, "Q3" and "report.pdf"

20. Counting error lines in a log

Which command prints how many lines in app.log contain "ERROR"?

1. A.grep -l ERROR app.log
2. B.grep -o ERROR app.log | head -1
3. C.grep -c ERROR app.log
4. D.wc -w app.log | grep ERROR

21. How passwd edits a root-owned file

A normal user runs passwd and it updates /etc/shadow, which only root can write. Why does this work?

$ ls -l /usr/bin/passwd
-rwsr-xr-x 1 root root 59976 /usr/bin/passwd

1. A.The setuid bit makes passwd run with the file owner's (root's) privileges
2. B.passwd asks the sudo daemon to write the file for the user
3. C./etc/shadow allows writes from any program in /usr/bin
4. D.The kernel lets every user change their own line in any file

22. Symbolic chmod as a number

A file's permissions are set with the command below. What is the equivalent octal mode?

chmod u=rwx,g=rx,o= deploy.sh

1. A.755
2. B.740
3. C.570
4. D.750

23. Execute permission on a directory

A directory has mode 711 (rwx--x--x). What can another user do with it?

1. A.List the file names inside but not open any of them
2. B.Neither list it nor open anything inside it
3. C.Open a known file inside, but not list the directory
4. D.Create new files inside but not read existing ones

24. Deleting a read-only file

A file is owned by root with mode 444, but it sits in a directory that you own with mode 755. Can you delete it with rm -f?

1. A.No, deleting always needs write permission on the file
2. B.Yes, deleting needs write on the directory, not on the file
3. C.No, only root can delete files that root owns
4. D.Yes, but only after running chmod on the file first

25. SSH refuses a private key

ssh -i deploy.pem prints "UNPROTECTED PRIVATE KEY FILE! Permissions 0644 are too open" and ignores the key. What is the fix?

1. A.chmod 755 deploy.pem so ssh can execute it
2. B.chmod 600 deploy.pem so only the owner can read it
3. C.Copy the key into /etc/ssh so root owns it
4. D.Regenerate the key with a longer bit length

26. Reading a crontab line

When does this crontab entry run?

30 2 * * 1 /opt/scripts/cleanup.sh

1. A.At 01:30 on the 2nd of every month
2. B.At 02:30 every Monday
3. C.Every 30 minutes on the 2nd and 1st hour
4. D.At 02:30 on the 1st of every month

27. Boot hangs on a missing data disk

A cloud VM drops into emergency mode at boot because an extra data volume in /etc/fstab was detached. What fstab option lets it boot when that disk is absent?

1. A.noatime
2. B.defaults
3. C.nofail
4. D.errors=remount-ro

28. High st on a cloud VM

On a cloud VM, top shows %st (steal) at 25% while the app gets slower. What does steal time mean?

1. A.The hypervisor gave this vCPU's time to other guests
2. B.Another process in this VM took the CPU from yours
3. C.The kernel spent the time on memory compaction
4. D.Time spent waiting for the NFS server to answer

29. Every first request takes 5 seconds

curl to any host name pauses about 5 seconds before connecting, but curl to an IP address is instant. What is the likely cause?

1. A.The first nameserver in resolv.conf is timing out
2. B.The TLS handshake is failing and retrying
3. C.The server's TCP backlog is full
4. D.The local firewall is rate limiting curl

30. Sockets stuck in CLOSE_WAIT

A service has thousands of sockets in CLOSE_WAIT that never go away. Where is the problem?

1. A.The remote side never sent its final ACK
2. B.The local app got FIN but never closed the socket
3. C.The kernel TCP timers are set too high
4. D.A firewall is dropping the FIN packets

31. Port open locally, not from outside

curl localhost:9200 works on the server but other hosts cannot connect. The firewall is open. What does this ss line explain?

LISTEN 0 4096 127.0.0.1:9200 0.0.0.0:* users:(("java",pid=812))

1. A.The backlog of 0 means no new connections are accepted
2. B.Port 9200 is reserved for local users by the kernel
3. C.The java process has not finished starting up yet
4. D.It listens only on loopback, so remote clients cannot reach it

32. Restarting a crashed service

A worker sometimes crashes. You want systemd to restart it after crashes but not when an admin stops it with systemctl stop. Which setting fits?

1. A.Restart=no with a watchdog script in cron
2. B.RemainAfterExit=yes
3. C.Restart=on-failure with a RestartSec delay
4. D.Type=oneshot

33. Changing a packaged unit safely

You need to add an environment variable to the vendor nginx.service. Editing /usr/lib/systemd/system/nginx.service works, but is a bad idea. Why, and what is better?

1. A.systemd ignores edits under /usr; copy it to /tmp
2. B.It breaks the package signature; reinstall nginx instead
3. C.Variables must go in /etc/environment for all units
4. D.Upgrades overwrite it; use systemctl edit for an override.conf drop-in

34. Accept rule that never matches

Port 8443 is still blocked after you added the rule below. Why?

$ iptables -L INPUT -n --line-numbers
1  ACCEPT  tcp  --  0.0.0.0/0  0.0.0.0/0  tcp dpt:22
2  DROP    all  --  0.0.0.0/0  0.0.0.0/0
3  ACCEPT  tcp  --  0.0.0.0/0  0.0.0.0/0  tcp dpt:8443

1. A.iptables needs a reboot before new rules apply
2. B.ACCEPT rules only work for ports below 1024
3. C.Rules match in order; rule 2 drops it first
4. D.Rule 3 needs to name the interface to be valid

35. Keeping one package at its version

You must keep the docker-ce package at its current version while running "apt upgrade" for security patches. What should you do?

1. A.apt remove docker-ce before upgrading
2. B.apt-mark hold docker-ce
3. C.apt upgrade --no-docker
4. D.Delete docker-ce from sources.list only

36. Which interface traffic will use

A server has two NICs and several routes. How can you see exactly which interface and source IP it will use to reach 172.16.4.10?

1. A.ip route get 172.16.4.10
2. B.ip link show 172.16.4.10
3. C.arp 172.16.4.10
4. D.ping -c1 172.16.4.10

37. Reading a file one line at a time

hosts.txt has one entry per line, and some lines contain spaces and backslashes. Which loop processes exactly one full line per pass?

1. A.for line in $(cat hosts.txt); do ...; done
2. B.for line in "hosts.txt"; do ...; done
3. C.while IFS= read -r line; do ...; done < hosts.txt
4. D.while read line hosts.txt; do ...; done

38. Creating a temp file safely

Why is tmp=$(mktemp) better than tmp=/tmp/myscript.$$ in a script run as root?

1. A.It makes a unique file atomically, so no one can pre-create the name
2. B.It keeps the file in RAM, which is faster than disk
3. C.It deletes the file automatically when the script ends
4. D.It is the only way to write to /tmp as root

39. Matching a file name pattern

Which test is true when $file ends in ".log"?

1. A.[[ $file == "*.log" ]]
2. B.[ $file -eq *.log ]
3. C.[[ $file == *.log ]]
4. D.[[ $file = ~.log ]]

40. Writing a script with a heredoc

A setup script writes a helper file that must keep $HOME and $(date) as literal text. Which heredoc does that?

1. A.cat > helper.sh <<EOF ... EOF
2. B.cat > helper.sh <<-EOF ... EOF
3. C.cat > helper.sh <<'EOF' ... EOF
4. D.cat > helper.sh <<"$EOF" ... EOF

41. Listen queue overflows

During traffic spikes clients see connect timeouts, but the server process is not CPU bound. netstat -s shows the counters below rising. What does this indicate?

  48213 times the listen queue of a socket overflowed
  48213 SYNs to LISTEN sockets dropped

1. A.The accept backlog is full because the app accepts connections too slowly or the backlog is too small
2. B.The TLS handshake is failing because of an expired certificate
3. C.The disk is full so new sockets cannot be created
4. D.The client is using the wrong port

42. Invalid cross-device link

ln /data/big.iso /home/me/big.iso fails with "Invalid cross-device link". /data and /home are separate filesystems. Why?

1. A.Hard links are allowed only for files smaller than 4 GB
2. B.Inode numbers only mean something inside one filesystem
3. C.Hard links need both folders to have the same owner
4. D.The target folder must be mounted with the "links" option

43. Disk 100% for users but not for root

df shows /data at 100% Use and normal users get "No space left", yet Used is clearly less than Size and root can still write. What is going on?

Filesystem  Size  Used Avail Use% Mounted on
/dev/sdb1   1.0T  950G     0 100% /data

1. A.The filesystem has run out of inodes, not blocks
2. B.A deleted file is still open and holding the space
3. C.ext4 keeps about 5% of blocks reserved for root by default
4. D.df counts the journal as user data on ext4

44. Setuid on a Bash script

You set chmod u+s on a root-owned Bash script so users can run one admin task. It still runs as the calling user. Why?

1. A.The setuid bit only works for files in /usr/sbin
2. B.Bash drops the bit unless the script ends in .sh
3. C.Linux ignores the setuid bit on interpreted scripts
4. D.The bit only applies after the next reboot

45. Root denied on an NFS share

On an NFS client, root gets "Permission denied" writing to a share that a normal user with the matching UID can write to. What is the usual reason?

1. A.NFS only allows writes from users without a shell
2. B.The client kernel blocks root from all network filesystems
3. C.The server's root_squash maps client root to an unprivileged user
4. D.The share is mounted with noexec, which also blocks root writes

46. Root cannot delete a file

As root, rm /etc/resolv.conf says "Operation not permitted". The filesystem is mounted read-write and permissions look normal. What should you check next?

1. A.ls -Z for a missing SELinux label on the file
2. B.getfacl for an ACL that denies root
3. C.lsattr for the immutable flag set with chattr +i
4. D.stat for a hard link count above one

47. Bad interpreter with a ^M

A script edited on Windows fails with "/bin/bash^M: bad interpreter: No such file or directory". What is wrong?

1. A.The file has CRLF line endings, so the shebang names "bash\r"
2. B.Bash is not installed in /bin on this distribution
3. C.The script lacks execute permission for its owner
4. D.The first line must be #!/usr/bin/env sh on Linux

48. %util at 100% on an NVMe drive

iostat shows an NVMe volume at 100% util, but latency (await) is still low and throughput keeps rising as load grows. How should you read this?

1. A.The disk is saturated and must be replaced at once
2. B.The figure is wrong because NVMe has no queue
3. C.%util means "busy at least once"; parallel devices can do far more
4. D.It means the page cache is full and writes are blocked

49. Uneven speed on a two-socket server

On a two-socket server, a latency-sensitive process sometimes runs 30% slower. numastat shows most of its memory on node 1 while it runs on CPUs of node 0. What is happening?

1. A.Node 1 memory is faulty and the kernel retries reads
2. B.The kernel is swapping its memory between the two nodes
3. C.The process lacks permission to use node 0 memory
4. D.It pays the cost of remote NUMA memory; bind CPU and memory to one node

50. malloc succeeded, then OOM kill

A program's malloc of 20 GB succeeds on a 16 GB box, but the process is OOM-killed later while filling the buffer. Why did malloc not fail?

1. A.malloc always reserves swap first, then RAM
2. B.The kernel moved the buffer to another NUMA node
3. C.Linux overcommits; memory is only taken when pages are touched
4. D.malloc returns a fake pointer when memory is short

51. Running strace on a busy service

Why is attaching strace to a busy production database risky, and what is a lower-overhead option?

1. A.strace restarts the process; use gdb instead
2. B.strace needs a reboot to detach; use lsof instead
3. C.ptrace stops it at every syscall; eBPF tools cost far less
4. D.strace writes to the database files; use ltrace instead

52. Latency improves under load

A low-latency trading gateway is faster when the box is busy than when it is idle. cpupower frequency-info shows the "powersave" governor. What is the likely explanation?

1. A.Idle cores clock down and take time to ramp up
2. B.The kernel batches network packets only when idle
3. C.Busy servers get priority on the network switch
4. D.The page cache is cleared when CPU usage is low

53. RAM used but no process owns it

A 64 GB server shows 40 GB used, yet process RSS adds up to under 10 GB and cache is small. /proc/meminfo shows HugePages_Total: 15000 with Hugepagesize 2048 kB. What explains it?

1. A.About 30 GB is reserved as huge pages, used or not
2. B.The kernel has leaked 30 GB and needs a reboot
3. C.The huge page count is in kB, so it is only 15 MB
4. D.RSS excludes stack memory, which holds the rest

54. Start request repeated too quickly

After you fix a config bug, "systemctl start api" still fails with "start request repeated too quickly". What is happening?

1. A.The fixed config has not been compiled into the unit
2. B.systemd blocks a unit for 24 hours after any crash
3. C.It hit the start limit; run reset-failed, then start
4. D.The api binary is locked until the next reboot

55. Service writes to /tmp but nothing is there

A service logs that it wrote /tmp/export.csv, but ls /tmp on the host shows no such file. The unit has PrivateTmp=yes. Where is the file?

1. A.Nowhere; PrivateTmp makes /tmp writes fail silently
2. B.In /var/tmp, where systemd redirects all /tmp writes
3. C.In RAM only, and it was lost when the shell started
4. D.In a private /tmp under /tmp/systemd-private-*-<unit>-*/tmp

56. Cannot mount root after a hardware change

After moving a VM disk to a different virtual storage controller, boot fails with "unable to mount root fs" while the disk is fine. What is the likely cause?

1. A.The initramfs lacks the new controller's driver; rebuild it
2. B.The root filesystem was corrupted by the move
3. C.GRUB cannot read disks bigger than 2 TB
4. D.The kernel needs a new licence key for the hardware

57. nginx cannot bind to port 8081

On RHEL with SELinux enforcing, nginx fails to start on port 8081 with "Permission denied" on bind, while port 80 works. What is the proper fix?

1. A.setsebool -P httpd_can_network_connect 1
2. B.chmod 755 /usr/sbin/nginx
3. C.semanage port -a -t http_port_t -p tcp 8081
4. D.Run nginx as root with setenforce 0

58. Failure hidden inside a function

Inside a function, curl fails, but $? is 0 and set -e does not stop the script. Why?

fetch() {
  local body=$(curl -fsS "$URL")
  echo "status: $?"
}

1. A.curl -f always returns 0 on HTTP errors
2. B.Command substitution never reports errors in Bash
3. C.Functions reset $? to 0 when they start
4. D.$? is the exit status of local, which succeeded

59. Cron job runs twice at once

A sync script runs every 5 minutes from cron. Sometimes it takes 8 minutes and two copies corrupt the data. What is a robust fix?

1. A.Check for a PID file with [ -f ] and create it if absent
2. B.Run it every 10 minutes instead of every 5
3. C.Wrap it with flock -n /run/sync.lock so a second copy exits
4. D.Add sleep 300 at the end of the script

60. Command found, but not under sudo

kubectl is in /opt/tools/bin, which is on your PATH. Running "sudo kubectl get nodes" gives "command not found". Why?

1. A.kubectl refuses to run as the root user
2. B.sudo uses secure_path from sudoers, not your PATH
3. C.sudo only runs commands in /usr/sbin
4. D.Root needs its own copy of the kubeconfig first