Linux and Shell Scripting Interview Questions (2026 Master Guide)

Q1. Explain the Linux File System Hierarchy (FHS) and key directories.

Foundation • 0-2 Yrs

/ (root directory): Top of hierarchy. /bin: Essential user command binaries. /sbin: System binaries for root administration. /etc: Configuration files. /dev: Device nodes. /proc: Virtual filesystem presenting process and kernel status. /var: Variable data (logs, mail spools). /tmp: Temporary files. /home: User home directories.

Q2. Explain Linux File Permissions: Read, Write, Execute (rwx) and numeric octal representation.

Foundation • 0-2 Yrs

Permissions are divided into 3 sets: Owner, Group, and Others. r (Read = 4), w (Write = 2), x (Execute = 1). Octal 755 represents rwxr-xr-x (Owner has full permissions; Group and Others have read and execute). chmod alters permissions; chown alters user and group ownership.

Q3. What is the difference between a Hard Link and a Soft (Symbolic) Link?

Foundation • 0-2 Yrs

Hard Link: Directly references the underlying disk inode of a file; deleting the original file leaves the hard link intact (data accessible until all hard links are removed); cannot link directories or cross filesystems. Soft Link: Small pointer file storing the pathname of target file; breaks (dangling link) if original file is deleted or moved.

Q4. Explain the difference between grep, egrep, and fgrep.

Foundation • 0-2 Yrs

grep (Global Regular Expression Print): Matches standard basic regular expressions (BRE). egrep (equivalent to grep -E): Matches extended regular expressions (ERE: +, ?, |, parentheses without backslashes). fgrep (equivalent to grep -F): Matches fixed literal strings without regex parsing (fastest search).

Q5. What is the difference between Redirection (> and >>) and Piping (|)?

Foundation • 0-2 Yrs

Redirection (> overwrites, >> appends): Directs the standard output (stdout) of a command into a file. Piping (|): Sends the stdout of one command directly as the standard input (stdin) of the next command in memory without using intermediate files.

Q6. Explain the three standard Linux streams: stdin (0), stdout (1), and stderr (2).

Foundation • 0-2 Yrs

stdin (File Descriptor 0): Standard input stream (keyboard/pipe). stdout (FD 1): Standard output stream (terminal display). stderr (FD 2): Standard error stream (error messages). To redirect errors to /dev/null: command 2>/dev/null; to merge output and error: command > file 2>&1 or command &> file.

Q7. How do you inspect running processes in Linux (ps vs top vs htop)?

Foundation • 0-2 Yrs

ps: Provides a static snapshot of current processes (ps aux or ps -ef). top: Real-time dynamic interactive view of running processes, CPU load, memory utilization, and uptime. htop: Enhanced interactive top with color-coded CPU cores, tree view, and mouse navigation.

Q8. What are Process Signals and what is the difference between SIGTERM (15) and SIGKILL (9)?

Foundation • 0-2 Yrs

Signals communicate with processes. SIGTERM (Signal 15): Graceful termination signal; the process can catch it, close files, release DB connections, and shut down cleanly. SIGKILL (Signal 9): Immediate un-catchable kernel termination; the process is instantly killed without cleanup.

Q9. What is a Zombie Process vs an Orphan Process?

Foundation • 0-2 Yrs

Orphan Process: A child process whose parent died before it finished; the 'init' process (PID 1) automatically adopts it and reaps its exit status. Zombie Process: A process that has completed execution but remains in the process table because its parent has not yet read its exit status via wait().

Q10. What is a Cron Job and how do you configure crontab syntax?

Foundation • 0-2 Yrs

Cron is a background daemon that executes scheduled tasks. Crontab syntax uses 5 fields: Minute (0-59), Hour (0-23), Day of Month (1-31), Month (1-12), Day of Week (0-6, Sunday=0): * * * * * /path/script.sh. Edit via crontab -e and list via crontab -l.

Q11. What is the difference between find and locate commands?

Foundation • 0-2 Yrs

find: Searches the live physical filesystem in real-time based on criteria (name, size, mtime, permissions); thorough and accurate but slower on large disks. locate: Queries a pre-built indexed database (updated via updatedb); executes in milliseconds but cannot find newly created files.

Q12. Explain the difference between tar and gzip.

Foundation • 0-2 Yrs

tar (Tape Archive): Bundles multiple files and directories into a single uncompressed .tar archive file without reducing file size. gzip: Compresses a single file into a smaller .gz file. Combining both (tar -czvf archive.tar.gz folder/) archives and compresses simultaneously.

Q13. What is systemd and what are systemctl commands?

Foundation • 0-2 Yrs

systemd is the standard modern init system and service manager (PID 1) for Linux. Key commands: systemctl start , systemctl stop , systemctl restart , systemctl status , and systemctl enable (enables launch on boot).

Q14. What is the difference between an absolute path and a relative path?

Foundation • 0-2 Yrs

Absolute Path: Specifies the location from the root directory (/), always beginning with / (e.g., /var/log/nginx/error.log). Relative Path: Specifies the location relative to the current working directory, using . (current) and .. (parent, e.g., ../config/app.conf).

Q15. What are environment variables and what is the difference between export and local variables?

Foundation • 0-2 Yrs

Local variables exist only within the current shell session. The 'export' command (e.g., export DB_HOST=localhost) exports the variable into the environment, making it inherited and accessible by child processes and subshells launched from that shell.

Q16. Explain how the 'awk' utility processes text line-by-line.

Experienced • 3-5+ Yrs

awk operates as a data-driven pattern-action language. It reads input line by line, splits each line into fields ($1, $2, ... $NF; $0 represents entire line) using Field Separator (FS, default whitespace). Structure: BEGIN { ... } pattern { action } END { ... }. Excellent for tabular reports.

Q17. What is 'sed' (Stream Editor) and how does in-place text substitution work?

Experienced • 3-5+ Yrs

sed parses text streams and performs non-interactive editing. The substitute command sed 's/old/new/g' replaces patterns. The -i flag (sed -i 's/old/new/g' file.txt) executes in-place editing directly on the target file on disk.

Q18. How do you troubleshoot a server experiencing high CPU Load Average when top shows low CPU%?

Experienced • 3-5+ Yrs

Load Average represents the average number of processes in a runnable or uninterruptible sleep state (D state). If CPU utilization is low, processes are waiting in uninterruptible sleep on Disk I/O or NFS storage bottlenecks. Run iostat -x 1, vmstat 1, or dstat to verify disk %util and await times.

Q19. Explain how Swap Space works and how 'swappiness' affects performance.

Experienced • 3-5+ Yrs

Swap space is virtual memory on disk used when physical RAM is exhausted. Swappiness (sysctl vm.swappiness, 0 to 100) controls how aggressively the Linux kernel moves inactive anonymous memory pages from RAM to swap. For low-latency production servers (databases, K8s), swappiness is set to 1 or 0.

Q20. How do you handle log rotation in production Linux systems (logrotate)?

Experienced • 3-5+ Yrs

The logrotate daemon prevents disk saturation by rotating, compressing, and purging old log files based on configuration in /etc/logrotate.conf. Directives include: daily/weekly, rotate 7 (keep 7 copies), compress, delaycompress, and postrotate (reloads service daemon).

Q21. What is the OOM (Out Of Memory) Killer in the Linux kernel?

Experienced • 3-5+ Yrs

When the system is critically low on physical memory and swap, the OOM Killer kernel heuristic selects and kills memory-hungry processes to prevent total system kernel panic. Each process has an oom_score (in /proc//oom_score); processes with highest scores are killed first.

Q22. Explain how SSH Key-Based Authentication works under the hood.

Experienced • 3-5+ Yrs

1. Client generates key pair (ssh-keygen: private key id_ed25519 and public key id_ed25519.pub); 2. Public key appended to server's ~/.ssh/authorized_keys; 3. Upon connection, server generates a random challenge encrypted with client's public key; 4. Client decrypts with private key and returns signature; 5. Server authenticates.

Q23. What is the difference between TCP and UDP sockets and how do you monitor them (ss vs netstat)?

Experienced • 3-5+ Yrs

TCP: Connection-oriented, reliable 3-way handshake, guaranteed packet delivery and order. UDP: Connectionless, lightweight, unordered broadcast. The modern ss command (Socket Statistics) queries the kernel directly via netlink, executing significantly faster than legacy netstat: ss -tulpn.

Q24. How do you secure a Linux server: SSH hardening and fail2ban?

Experienced • 3-5+ Yrs

1. Disable password authentication (PasswordAuthentication no); 2. Disable root login (PermitRootLogin no); 3. Change default port 22; 4. Use SSH key-based auth; 5. Deploy Fail2ban to monitor /var/log/auth.log and dynamically inject iptables rules blocking brute-forcing IPs.

Q25. What is the difference between RAID 0, RAID 1, RAID 5, and RAID 10?

Experienced • 3-5+ Yrs

RAID 0 (Striping): Performance without redundancy (failure of 1 disk loses all data). RAID 1 (Mirroring): 100% redundancy, 50% storage capacity. RAID 5 (Striping with Parity): Tolerates 1 disk failure, minimum 3 disks. RAID 10 (1+0): Striped mirrors, high performance and fault tolerance.

Q26. Explain the purpose of /etc/fstab and how to mount filesystems using UUIDs.

Experienced • 3-5+ Yrs

/etc/fstab contains static filesystem mounting configurations applied at boot. Referencing devices by UUID (Universally Unique Identifier obtained via blkid) prevents boot failures if drive letters (/dev/sda, /dev/sdb) shift upon hardware changes.

Q27. What is SELinux and what are its three modes (Enforcing, Permissive, Disabled)?

Experienced • 3-5+ Yrs

Security-Enhanced Linux (SELinux) implements Mandatory Access Control (MAC) in the kernel. Enforcing: Enforces security policies and logs violations. Permissive: Does not block actions but logs policy violations (ideal for troubleshooting). Disabled: Completely turns off SELinux.

Q28. How do you troubleshoot network connectivity issues step-by-step in Linux?

Experienced • 3-5+ Yrs

1. Physical/Link layer: ip link show (check interface UP); 2. IP configuration: ip addr show; 3. Local gateway: ping ; 4. Routing table: ip route show; 5. DNS resolution: dig / nslookup google.com; 6. Remote port accessibility: curl -Iv https://target or nc -zv target 443.

Q29. Explain set -e, set -u, set -o pipefail in robust Bash scripting.

Experienced • 3-5+ Yrs

set -e (exit on error): Terminates script immediately if any command returns non-zero. set -u (unset variables): Treats uninitialized variables as errors. set -o pipefail: Ensures a piped command pipeline returns non-zero if ANY command in the pipeline fails, preventing silent pipe errors.

Q30. What is an inode and what happens when a filesystem runs out of inodes?

Experienced • 3-5+ Yrs

An inode is a data structure storing file metadata (permissions, owner, size, timestamps, disk block pointers) excluding filename and file data. If a filesystem runs out of inodes (e.g., millions of tiny zero-byte files), no new files can be created even if gigabytes of free disk space exist.

Q31. Write an awk command to print the IP address and HTTP status code from an Apache/Nginx access log.

Live Coding Challenge

Print field 1 and field 9 from access.log.

awk '{print $1, $9}' /var/log/nginx/access.log | head -n 20

Q32. Write a sed command to replace all occurrences of 'http://' with 'https://' across all .html files.

Live Coding Challenge

Use sed with -i and global flag.

sed -i 's|http://|https://|g' *.html

Q33. Write a Bash script to monitor disk usage and send an email alert if usage exceeds 85%.

Live Coding Challenge

Script checks df -H, extracts percentage, and triggers mail.

#!/bin/bash
THRESHOLD=85
CURRENT=$(df / | grep / | awk '{ print $5 }' | sed 's/%//g')
if [ "$CURRENT" -gt "$THRESHOLD" ]; then
    echo "Warning: Disk usage on root filesystem is at ${CURRENT}%!" | mail -s "Disk Alert: ${HOSTNAME}" admin@example.com
fi

Q34. Write a Linux command to find and delete all files in /tmp older than 7 days.

Live Coding Challenge

Use find with -type f, -mtime +7, and -delete.

find /tmp -type f -mtime +7 -delete

Q35. Write a Bash script that takes a directory as an argument and counts total files and subdirectories.

Live Coding Challenge

Validate directory argument and count items using find.

#!/bin/bash
TARGET="${1:-.}"
if [ ! -d "$TARGET" ]; then
    echo "Error: $TARGET is not a directory."
    exit 1
fi
FILES=$(find "$TARGET" -maxdepth 1 -type f | wc -l)
DIRS=$(find "$TARGET" -maxdepth 1 -type d | wc -l)
echo "Directory: $TARGET has $FILES files and $((DIRS - 1)) subdirectories."

Q36. Write an awk one-liner to calculate the sum of the 3rd column in a comma-separated CSV file.

Live Coding Challenge

Set FS to comma and accumulate sum in END block.

awk -F',' '{sum += $3} END {print "Total Sum: ", sum}' data.csv

Q37. Write a command to list the top 10 memory-consuming processes.

Live Coding Challenge

Use ps aux with sort on %mem.

ps aux --sort=-%mem | head -n 11

Q38. Write a Bash loop to check if a list of servers are online using ping.

Live Coding Challenge

Loop through array of hosts and ping with 1 packet.

#!/bin/bash
SERVERS=("8.8.8.8" "1.1.1.1" "192.168.1.1")
for srv in "${SERVERS[@]}"; do
    if ping -c 1 -W 1 "$srv" &>/dev/null; then
        echo "$srv: ONLINE"
    else
        echo "$srv: OFFLINE"
    fi
done

Q39. Write a command to count the number of established TCP connections per IP address.

Live Coding Challenge

Use ss with awk, sort, and uniq -c.

ss -tn src :* | awk '{print $5}' | cut -d':' -f1 | sort | uniq -c | sort -nr | head -n 10

Q40. Write a robust Bash script header with strict error checking and cleanup trap.

Live Coding Challenge

Using set -euo pipefail and trap for EXIT.

#!/usr/bin/env bash
set -euo pipefail
IFS=$'\n\t'

cleanup() {
    echo "Cleaning up temporary resources..."
    rm -f /tmp/temp_process_$$
}
trap cleanup EXIT