Question 1

What's the difference between a hard link and a symbolic link?

Accepted Answer

A hard link is a second directory entry pointing to the same inode — it shares the same data blocks, has no independent existence from the original file, can't cross filesystems, and can't link to a directory. A symbolic link is a separate small file that stores a path to the target; it can cross filesystems and link to directories, but breaks if the target is moved or deleted (a 'dangling' link). Check inode numbers with `ls -i` to confirm two names are hard-linked to the same file.

Question 2

Explain what happens, step by step, when a Linux system boots.

Accepted Answer

Firmware (BIOS/UEFI) runs POST and hands off to the bootloader (GRUB2), which loads the kernel and an initial RAM filesystem (initramfs) into memory. The kernel initializes hardware and drivers, mounts the real root filesystem, then starts systemd as PID 1. systemd works through a dependency graph of units, reaching sysinit.target, then basic.target, then multi-user.target (or graphical.target), starting services along the way, until a login prompt or display manager is ready.

Question 3

How do you find which process is listening on a specific port?

Accepted Answer

`ss -tulnp | grep :80` shows the process and PID bound to port 80 (requires root or sudo to see the PID for processes you don't own). The older equivalent is `netstat -tulnp`. Once you have the PID, `ps -fp PID` or `/proc/PID/cmdline` shows the full command that started it.

Question 4

What's the difference between chmod 755 and chmod 644?

Accepted Answer

755 = rwxr-xr-x — the owner gets read/write/execute, group and others get read/execute only. Used for executables and directories (execute permission on a directory means 'can cd into it / list contents with the right read bit'). 644 = rw-r--r-- — owner gets read/write, everyone else gets read-only. Used for regular data/config files that shouldn't be executed.

Question 5

How would you find and delete all files larger than 100MB modified in the last 7 days?

Accepted Answer

`find / -type f -size +100M -mtime -7` lists them; append `-delete` to remove them directly, or pipe to `xargs rm -v` for a verbose delete. Always run the find without `-delete` first to review the list — an unqualified find across `/` can match files you didn't intend to touch.

Question 6

What is the difference between a process and a thread on Linux, and how do you see both?

Accepted Answer

A process has its own memory space, file descriptors, and PID; a thread shares memory space with other threads in the same process but has its own stack and register state. `ps -eLf` or `top -H` shows threads (LWPs) within each process. On Linux, threads are actually implemented as processes that share resources via clone() flags — so `/proc/PID/task/` lists each thread as its own directory.

Question 7

How do you extend a logical volume and its filesystem without unmounting it?

Accepted Answer

Extend the LV first: `lvextend -L +10G /dev/vgdata/lvdata`. Then grow the filesystem live — for ext4: `resize2fs /dev/vgdata/lvdata`; for XFS: `xfs_growfs /mount/point` (XFS can only grow, never shrink, and must be referenced by mount point, not device). Both commands are safe on a mounted, in-use filesystem.

Question 8

What's the difference between a systemd service, target, and timer unit?

Accepted Answer

A .service unit defines something to run (a daemon or one-shot command). A .target unit is a synchronization point that groups other units together (like multi-user.target) — it doesn't do anything itself. A .timer unit triggers an associated .service on a schedule (calendar-based or relative), acting as a more capable, loggable replacement for cron.

Question 9

How do you troubleshoot a service that fails to start under systemd?

Accepted Answer

`systemctl status servicename` shows the last few log lines and the exit code/signal. `journalctl -u servicename -xe` shows the full, detailed logs including systemd's own diagnostic hints. Common causes: a config file syntax error (test with the daemon's own `-t`/`configtest` flag if it has one), a port already in use, wrong permissions on a file it needs, or a missing dependency unit.

Question 10

What is the purpose of the sticky bit, and where is it commonly used?

Accepted Answer

The sticky bit (chmod +t, shown as a 't' in the others-execute position) on a directory means only the file's owner, the directory's owner, or root can delete or rename files inside it — even if others have write permission on the directory. /tmp is the canonical example: everyone needs write access to create temp files, but you shouldn't be able to delete someone else's.

Question 11

How does DNS resolution order work on a Linux host?

Accepted Answer

It's controlled by /etc/nsswitch.conf's `hosts:` line, typically `files dns` — meaning /etc/hosts is checked first, then DNS servers listed in /etc/resolv.conf (or managed by systemd-resolved/NetworkManager). `getent hosts hostname` shows the actual resolved result following that order, which is more reliable for debugging than assuming DNS alone.

Question 12

What's the difference between a soft and hard ulimit, and how do you change them permanently?

Accepted Answer

The soft limit is the currently enforced cap a process can raise up to the hard limit without extra privilege; the hard limit is the ceiling only root can raise. `ulimit -Sn`/`ulimit -Hn` show current shell values. For persistent changes (e.g. raising open-file limits for a service), edit /etc/security/limits.conf or, for a systemd service, set `LimitNOFILE=` in its unit file — /etc/security/limits.conf is not honored by services started directly by systemd.

Question 13

How do you check which package installed a specific file?

Accepted Answer

On Debian/Ubuntu: `dpkg -S /path/to/file`. On RHEL/Rocky/Fedora: `rpm -qf /path/to/file`. This is the fastest way to confirm whether a suspicious binary belongs to a legitimate package before deciding whether to remove it.

Question 14

Explain the difference between SIGTERM and SIGKILL, and why you should try SIGTERM first.

Accepted Answer

SIGTERM (`kill PID`, signal 15) asks a process to terminate gracefully — it can catch the signal, flush buffers, close file handles, and exit cleanly. SIGKILL (`kill -9 PID`) is delivered directly by the kernel and cannot be caught, blocked, or ignored — the process is terminated immediately with no cleanup, which can corrupt open files or leave locks/resources dangling. Always try SIGTERM first and only escalate to SIGKILL if the process doesn't respond after a reasonable wait.

Question 15

What's the difference between /etc/passwd and /etc/shadow?

Accepted Answer

/etc/passwd holds user account metadata (username, UID, GID, home directory, login shell) and is world-readable, which every tool that resolves usernames relies on. /etc/shadow holds the actual hashed passwords plus password-aging policy, and is readable only by root — passwords were split out of /etc/passwd specifically so that account metadata could stay world-readable without exposing password hashes.

Question 16

How would you diagnose a server that suddenly has high load average but low CPU usage?

Accepted Answer

Load average on Linux counts processes in uninitializable (D) state, not just runnable ones — so high load with low CPU usually means processes are blocked on I/O. Check `ps aux` for processes in state D, `iostat -x 1` for disk saturation (%util near 100), and `iotop` to find which process is generating the I/O. This is a classic 'disk is the bottleneck, not CPU' scenario.

Question 17

What is the difference between a package repository's 'update' and 'upgrade' commands?

Accepted Answer

`apt update` (or `dnf makecache`) refreshes the local index of available packages and their versions from the configured repositories — it installs nothing. `apt upgrade` (or `dnf upgrade`) actually installs newer versions of packages already on the system, based on that refreshed index. Running upgrade without a preceding update just re-installs against a stale package list.

Question 18

How do you find out why a filesystem shows 100% used by df but du shows much less space consumed?

Accepted Answer

This almost always means a file was deleted while a process still has it open — the inode and its data blocks aren't freed until the last file descriptor referencing it is closed, so `df` (which reads actual block allocation) still counts the space while `du` (which walks the visible directory tree) doesn't see the file anymore. Find the culprit with `lsof +L1` (lists open files with a link count of 0) or `lsof | grep deleted`, then restart or signal the owning process to release the handle.

Question 19

What's the difference between UDP and TCP that matters operationally when troubleshooting connectivity?

Accepted Answer

TCP is connection-oriented with handshakes, acknowledgments, and retransmission — a failed TCP connection gives you clear signals (SYN sent, no SYN-ACK = firewall drop; RST = port closed but reachable). UDP is connectionless and stateless — a UDP packet can vanish silently with no error, which is why DNS (mostly UDP) failures can look like 'nothing happens' rather than a clean rejection. `tcpdump` on both ends is the definitive way to see whether packets are actually leaving/arriving versus being silently dropped.

Question 20

How do you set up passwordless SSH login and what's the security risk if done carelessly?

Accepted Answer

Generate a key pair (`ssh-keygen -t ed25519`), copy the public key to the target's `~/.ssh/authorized_keys` (via `ssh-copy-id`), then disable password auth in sshd_config once key auth is confirmed working. The risk: an unencrypted private key on a workstation that gets compromised grants immediate access to every server trusting it — always protect the private key with a passphrase and an ssh-agent, and never copy private keys between machines.

Question 21

What RHCSA-relevant command would you use to boot into single-user (rescue) mode to reset a forgotten root password?

Accepted Answer

At the GRUB menu, edit the boot entry (`e`), find the line starting with `linux` or `linux16`, and append `rd.break` (or `single`/`init=/bin/bash` on older systems) at the end, then boot with Ctrl+X. This drops you into an emergency shell before init starts, where you remount the root filesystem read-write, run `passwd` to reset root's password, then relabel SELinux contexts (`touch /.autorelabel`) before rebooting normally — skipping the autorelabel step is the most common reason this procedure 'doesn't work' on SELinux-enabled systems.

Linux Interview Questions & Answers

All 21 Questions

Explore More