Linux is the operating system that runs the cloud, so strong Linux fundamentals are non-negotiable in any DevOps, SRE or cloud interview. This 2026 guide covers the questions you are most likely to be asked, from fundamentals to real troubleshooting scenarios.
Linux Fundamentals
What happens during the Linux boot process?
BIOS/UEFI runs POST and hands off to the bootloader (GRUB), which loads the kernel and initramfs. The kernel mounts the root filesystem and starts the first process, init — on modern systems that is systemd (PID 1), which brings up services according to the default target.
Explain Linux file permissions.
Each file has read/write/execute permissions for owner, group and others (e.g., rwxr-xr-x = 755). Numeric values: read=4, write=2, execute=1. Use chmod to change permissions, chown to change ownership, and umask to set defaults. Special bits include setuid, setgid and the sticky bit.
What is the difference between a hard link and a soft link?
A hard link is another name for the same inode (same data, same filesystem). A soft (symbolic) link is a pointer to a path and can span filesystems but breaks if the target is removed.
Processes and Signals
How do you view and manage processes?
Use ps, top/htop for a live view, and kill/pkill to send signals. SIGTERM (15) asks a process to stop gracefully; SIGKILL (9) force-terminates it; SIGHUP (1) often reloads configuration.
What is a zombie process?
A process that has finished but whose exit status hasn't been reaped by its parent. It holds a process-table entry until the parent calls wait(); many zombies usually indicate a buggy parent.
What is the load average?
The 1/5/15-minute average of runnable plus uninterruptible processes. Compare it to CPU core count — a sustained load above the number of cores suggests contention.
Storage and Filesystems
How do you check disk usage and find what is filling a disk?
Use df -h for filesystem usage and du -sh * to find large directories. If a deleted file is still held open by a process, space isn't freed until the process closes it — find it with lsof | grep deleted.
What is an inode?
A data structure storing a file's metadata (permissions, owner, size, block pointers) but not its name. A filesystem can run out of inodes even with free space — check with df -i.
Networking
How do you troubleshoot connectivity on Linux?
Check the interface and routes (ip addr, ip route), DNS resolution (dig/nslookup), reachability (ping, traceroute), and listening ports/connections (ss -tulpn). For application-level checks use curl -v.
How do you see which process is listening on a port?
ss -tulpn (or the older netstat -tulpn) lists listening sockets with the owning process.
systemd and Services
How do you manage services with systemd?
Use systemctl start|stop|restart|status|enable|disable <unit>. View logs with journalctl -u <unit> (add -f to follow, --since to filter by time).
Performance Troubleshooting
A server is slow — how do you investigate?
- Start with
top/htopand the load average to see CPU and memory pressure. - Check memory with
free -hand swap activity. - Check disk I/O with
iostatandiotop. - Check the OOM killer and errors in
dmesg/journalctl. - Correlate with recent deploys and application logs.
Scenario Questions
- "Disk full" but du shows little usage: likely a deleted-but-open file or inode exhaustion — check
lsof | grep deletedanddf -i. - SSH works but the app is unreachable: check the service status, the listening port (
ss -tulpn), and the firewall/security group. - Make a config change take effect safely: reload rather than restart where supported (
systemctl reloadorSIGHUP) to avoid downtime.
Keep Learning
Pair Linux fundamentals with our Terraform and Prometheus & Grafana guides, browse the full interview-questions library, and practise hands-on with DevOps training.
