Linux Interview Questions

Linux runs almost every server on the internet, so DevOps interviews almost always start here. The questions below cover the core skills you actually use on the job: file permissions, processes, the systemd init system, networking, disk usage, and the classic “the server is slow — what now?” scenarios. Each answer is short, accurate, and based on Ubuntu 22.04/24.04 LTS (the most common Long-Term Support release you will meet in production). Read them out loud once and you will sound confident in the room.

Permissions and ownership

How do Linux file permissions work?

Every file has three permission groups: the owner (the user who owns it), the group (a set of users), and others (everyone else). Each group can have read (r), write (w), and execute (x) permission. You see them with ls -l.

ls -l /etc/hosts

Output:

-rw-r--r-- 1 root root 220 Jun 10 09:14 /etc/hosts

Here rw- means the owner (root) can read and write, r-- means the group can only read, and the last r-- means others can only read.

What does chmod 755 mean?

Permissions can be written as numbers: read = 4, write = 2, execute = 1. You add them up per group. So 755 means owner = 7 (4+2+1 = read, write, execute), group = 5 (4+1 = read, execute), others = 5 (read, execute).

chmod 755 deploy.sh
chmod 644 config.yaml

755 is the standard for scripts and folders. 644 is standard for normal files (owner can edit, everyone else can only read).

Security tip: Never use chmod 777 (everyone can read, write, and execute). It is a common security hole because any user or compromised process can overwrite the file. Give the least permission that works.

What is the difference between chmod and chown?

chmod changes the permissions (what can be done). chown changes the owner and group (who owns it).

sudo chown www-data:www-data /var/www/html

This makes the web server user www-data the owner of the site files, which is what Nginx and Apache expect on Ubuntu.

What is sudo?

sudo (superuser do) lets a normal user run a single command as the root (administrator) user. It is safer than logging in as root because every sudo command is logged in /var/log/auth.log, and you only get root power for that one command.

Processes

How do you find and kill a process?

Use ps, top, or htop to find it, then kill to stop it. Every process has a PID (Process ID, a unique number).

ps aux | grep nginx
sudo kill 1834
sudo kill -9 1834

kill 1834 asks the process to stop politely (signal 15, SIGTERM). kill -9 forces it to stop immediately (signal 9, SIGKILL). When to use which: always try the normal kill first so the process can clean up; use -9 only when it is frozen and ignores you.

What is the difference between a foreground and background process?

A foreground process holds your terminal until it finishes. A background process runs while you keep using the terminal. Add & to run in the background, or press Ctrl+Z then type bg to push a running job to the background.

long-backup.sh &
jobs

What is a zombie process?

A zombie is a process that has finished but whose parent process has not yet read its exit status, so it stays in the process table as a Z state. Zombies use no CPU or memory and usually clear themselves. A growing pile of them means a buggy parent program — restart it.

systemd and services

What is systemd?

systemd is the init system on Ubuntu — the first program the kernel starts (PID 1), and the thing that starts, stops, and supervises all other services. You control it with the systemctl command.

How do you manage a service?

sudo systemctl start nginx
sudo systemctl stop nginx
sudo systemctl restart nginx
sudo systemctl status nginx
sudo systemctl enable nginx

Output:

● nginx.service - A high performance web server
     Loaded: loaded (/lib/systemd/system/nginx.service; enabled)
     Active: active (running) since Mon 2026-06-15 09:14:02 UTC; 2h ago

enable makes the service start automatically on every boot; start only starts it right now. You usually want both.

How do you read a service’s logs?

systemd collects logs in the journal, read with journalctl.

sudo journalctl -u nginx --since "1 hour ago"
sudo journalctl -u nginx -f

-u picks the service, and -f follows new lines live (like watching a tail).

Networking commands

How do you check which ports are listening?

A listening port means a program is waiting for connections. Use ss (the modern replacement for netstat).

sudo ss -tulpn

Output:

Netid State  Local Address:Port  Process
tcp   LISTEN 0.0.0.0:22          sshd
tcp   LISTEN 0.0.0.0:80          nginx
tcp   LISTEN 127.0.0.1:5432      postgres

The flags mean: t = TCP, u = UDP, l = listening, p = show the process, n = show numbers instead of names.

How do you test connectivity to another server?

ping google.com
curl -I https://example.com
dig example.com

ping checks if the host is reachable, curl -I fetches just the HTTP headers (good for checking a web service is up), and dig looks up DNS (Domain Name System — the phonebook that turns names into IP addresses).

How do you open a firewall port on Ubuntu?

Ubuntu uses ufw (Uncomplicated Firewall).

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status

Gotcha: Before you run ufw enable on a remote server, always allow SSH first (sudo ufw allow 22/tcp or sudo ufw allow OpenSSH). If you forget, the firewall will lock you out of your own server.

Disk and storage

How do you check disk space?

df shows free space per filesystem; du shows how much space folders use.

df -h
du -sh /var/log/*

Output:

Filesystem      Size  Used Avail Use% Mounted on
/dev/root        49G   46G  2.8G  95% /

-h means “human readable” (GB instead of raw blocks). The example above shows a nearly full disk — a real interview red flag.

Common scenarios

A server is running slow — what do you check?

Work top-down across the four resources: CPU, memory, disk, and network.

Step	Command	What you learn
Load and CPU	top or htop	Which process eats CPU
Memory	free -h	Is RAM or swap exhausted
Disk I/O	iostat -x 2	Is the disk the bottleneck
Disk space	df -h	Is a full disk causing failures
Logs	journalctl -p err -b	Recent errors since boot

Start with top. High load average with low CPU usage usually points to disk I/O waiting (the wa column).

The disk is full — how do you fix it fast?

1. Find the biggest offenders:

sudo du -sh /var/* | sort -rh | head

2. Clear old logs and package cache (usually the safe wins):

sudo journalctl --vacuum-time=3d
sudo apt clean

3. Look for huge log files in /var/log and rotate or truncate them. Never blindly delete files an app has open — truncate instead with sudo truncate -s 0 /var/log/huge.log.

How do you see what is using the most memory?

ps aux --sort=-%mem | head

This sorts all processes by memory use, biggest first.

Best practices

• Prefer sudo command over logging in as root, so every privileged action is logged.
• Use the least permission that works; avoid chmod 777 entirely.
• Use systemctl enable --now <service> to start a service and enable it at boot in one step.
• Always allow SSH in ufw before enabling the firewall on a remote machine.
• When the disk fills up, clear logs and caches first — they regenerate safely and rarely break the app.
• Read logs with journalctl -u <service> -f before guessing; the answer is usually in the logs.
• Truncate (truncate -s 0) busy log files instead of deleting them, so the writing process does not break.

Related Topics

• DevOps Interview Questions
• CI/CD Interview Questions
• Docker and Kubernetes Interview Questions
• Networking Interview Questions