A server reports 1GB of free memory via free -h, but a process fails to allocate a 1GB block. Why might this happen in a Linux environment?
Explain how Linux uses page tables and the MMU to provide each process with its own virtual address space.
Explain the difference between Resident Set Size (RSS) and Virtual Memory Size (VSZ) when looking at process memory.
Explain the difference between virtual memory and physical memory in Linux.
How does mmap work conceptually, and why might a developer use it instead of standard file I/O (read/write)?
What are Huge Pages in Linux, and in what specific scenarios would a software engineer enable them for their application?
What is the Out-Of-Memory Killer, and how does the kernel decide which process to sacrifice when the system runs out of RAM?
What is the vm.swappiness parameter, and what are the trade-offs of setting it very low versus very high?
Boot Process & Init Systems
Describe the Linux boot process from the moment the power button is pressed until the login prompt appears.
How do you enable a service to start at boot versus just starting it now with systemctl?
What is a unit in systemd, and what is the difference between a service unit and a target unit?
What is systemd and how does it differ from the legacy SysVinit (runlevels)?
What is the difference between systemd targets and traditional SysV runlevels?
What is the role of GRUB and the initramfs/initrd in the Linux boot process?
What is the role of PID 1 (systemd/init) in the Linux process tree, and what happens to a process's children if the parent dies unexpectedly?
Processes Signals & Scheduling
Explain copy-on-write (COW) in the context of the fork() system call.
Explain the concept of load average in Linux. What do the three numbers (1, 5, 15 minutes) actually represent in terms of CPU and I/O?
Explain the difference between SIGTERM and SIGKILL. When would you use one over the other?
How do you move a running foreground process to the background without stopping it? Explain the roles of Ctrl-Z, bg, and fg.
In tools like top, you might see a process consuming 150% or 400% CPU. How is this possible, and what does it tell you about the hardware?
What does it mean when a process is in 'Uninterruptible Sleep' (D state) in top, and why can't you kill a process in this state?
What does nohup and disown do, and how do they keep a job running after you log out?
What is 'niceness' in Linux process scheduling, and how does a high nice value affect a process's priority relative to the CFS?
What is a zombie process? Why can't you kill it with SIGKILL, and how do you actually remove it from the process table?
What is SIGHUP, and why do daemons often use it to reload their configuration?
What is the difference between an orphan process and a zombie process, and who becomes the parent of an orphan process in a modern systemd-based system?
What is the difference between fork() and exec()? What happens to the process ID and memory space during each?
What is the difference between kill, pkill, and killall?
What is the difference between SIGINT (Ctrl+C) and SIGTSTP (Ctrl+Z)?
Why can't a process ignore or catch a SIGKILL (9) signal?
Explain how an SSH tunnel works for port forwarding.
Explain the role of /etc/hosts versus /etc/resolv.conf. Which one does the system check first by default, and where is that order configured?
How do dig, nslookup, and host help troubleshoot DNS resolution on Linux?
How would you use ss or netstat to find which specific process is listening on port 8080?
What is netcat used for in Linux networking and troubleshooting?
What is nsswitch.conf and how does it control the order of name resolution sources?
What is rsync, and what advantages does it have over scp for transferring files?
What is the difference between curl and wget?
What is the difference between iptables and nftables, and how do firewall rules filter traffic?
What is the difference between ping and traceroute? How does traceroute use TTL to map a network path?
What is the difference between the ip command and the older ifconfig/route commands?
What is the difference between the netstat and ss commands?
What is the purpose of the lo (loopback) interface, and can a Linux system function correctly if it is disabled?
Permissions & Access Control
Explain how the umask value affects the default permissions of newly created files and directories.
Explain the difference between DAC (Discretionary Access Control) and MAC (Mandatory Access Control) like SELinux.
Explain the rwx permission model and how octal notation like 755 maps to symbolic permissions.
How does the /etc/sudoers file control what commands users can run, and why edit it with visudo?
What are POSIX ACLs, and how do getfacl and setfacl extend the traditional permission model?
What are the setuid and setgid bits, and what are the security implications of using them?
What is the 'sticky bit' on a directory like /tmp, and what specific security problem does it solve?
What is the difference between chmod, chown, and chgrp?
What is the difference between su and sudo? Why is sudo generally preferred in a production environment?
What is the principle of least privilege as it applies to Linux user accounts?
Explain stdin, stdout, and stderr. How do you redirect only the errors of a command to a file while keeping normal output on screen?
How do pipes work internally, and what happens to the first process if the second process in the pipe stops reading data?
What does '2>&1' signify at the end of a command?
What does the tee command do and when is it useful in a pipeline?
What is the difference between a pipe (|) and a redirection (>)? Explain how the shell handles data flow in cat file | grep 'error' > log.txt.
Containers Isolation & Hardening
Explain the concept of a chroot jail.
What are Linux Capabilities (e.g., CAP_NET_ADMIN), and how do they allow for more granular security than the traditional root/user model?
What are Linux namespaces and what specific types of isolation do they provide (e.g., PID, Net, Mount)?
What are Namespaces and Cgroups? Explain how these two specific kernel features provide the isolation needed for containers.
What is AppArmor and how does it compare to SELinux as a mandatory access control system?
What is fail2ban and how does it help protect a Linux server from brute-force attacks?
What is overlayfs (a union filesystem), and how do container images use it for layered storage?
Explain the difference between a hard link and a symbolic (soft) link. What happens to the file data if the original file is deleted in both cases?
Explain the role of the /etc/fstab file.
How does a Bind Mount differ from a regular mount in the context of Linux filesystems?
What are the differences between ext4, XFS, and Btrfs filesystems, and when might you choose one over another?
What are the different file types in Linux (regular, directory, symlink, socket, FIFO, device), and how do you identify them with ls -l?
What does the fsck utility do, and when is it run?
What does the mount command do, and how do you mount a filesystem manually versus persistently?
What happens to a file's inode when you move it within the same filesystem versus across different filesystems?
What is a journaling filesystem like ext4, and how does it help prevent data corruption during a sudden power loss?
What is an inode? If a disk has 50GB free but you get a 'No space left on device' error creating a tiny file, what is the likely cause?
What is an inode? If I rename a file, does its inode number change, and why or why not?
What is an inode? What information is stored in an inode, and what is specifically NOT stored there?
What is the /proc directory, and why are the files in it reported as 0 bytes in size even though they contain data?
What is the difference between du and df, and why might their reported values disagree?
What is the Filesystem Hierarchy Standard (FHS), and what is typically stored in /etc vs /var?
What is the purpose of the /proc and /sys virtual filesystems? Give an example of a piece of information you would look for there.
What is the Virtual File System, and how does it allow Linux to support multiple filesystem types simultaneously?
What is tmpfs, and how does it differ from a disk-backed filesystem?
When a large log file is deleted while a process is still writing to it, why is the disk space not reclaimed, and how do you fix it without a reboot?
Why can't hard links span across different filesystems or point to directories?
Shells & Command Execution
Explain the difference between running 'source script.sh' and executing it via './script.sh'.
How do globbing and wildcards work in the shell, and how do they differ from regular expressions?
How does command substitution using backticks or $() work?
How does the PATH environment variable influence how the shell finds executables?
What happens behind the scenes when you type 'ls' in a shell and hit Enter?
What is a TTY, and what is the difference between a terminal, a pseudo-terminal, and a console?
What is the $EDITOR variable, and how do vi/vim differ from nano for editing files?
What is the difference between a login shell and a non-login shell, and which configuration files are loaded in each?
What is the difference between a shell variable and an environment variable?
What is the difference between the various shells like bash, zsh, sh, and fish?
What is the exit status ($?) of a command and what conventions govern its values?
When you run a command in the shell, which environment variables are inherited by the child process, and how does the export command change this?
Kernel Architecture & Fundamentals
Explain the difference between User Space and Kernel Space. Why does this separation exist, and how does a process move between them?
Explain the Linux philosophy that 'Everything is a file.' Give examples of how this applies to hardware devices and network sockets.
Linux is described as a monolithic kernel. What does that mean in practice, and how do Loadable Kernel Modules change that definition?
What are system calls and how do they act as an interface between applications and the kernel?
What does the GPL license mean for the Linux kernel, and why is it significant?
What does uname tell you, and how do you interpret a Linux kernel version number?
What is a context switch in the context of the Linux kernel?
What is a system call, and how does it differ from a standard library function call?
What is the difference between a block device and a character device?
What is the difference between a process and a thread in the Linux kernel?
What is the difference between Linux and Unix?
What is the difference between the Linux kernel and a Linux distribution?
Package Management & Software Installation
How do package management systems differ between Debian-based (apt/dpkg) and RHEL-based (dnf/yum/rpm) distributions?
How would you compile and install software from source, and what does './configure && make && make install' actually do?
What is the difference between apt and dpkg, and when would you use each?
Users Authentication & SSH
How do you generate and use SSH key pairs, and why is key-based authentication preferred over passwords?
What are common practices for hardening SSH access on a production Linux server?
What information is stored in /etc/passwd versus /etc/shadow?
What is PAM (Pluggable Authentication Modules) and what role does it play in Linux authentication?
What is the difference between useradd and adduser, and how do you add a user to a group?
What is the role of ssh-agent and the ~/.ssh/config file?
System Services Logging & Scheduling
How do you set the system timezone and locale on Linux, and what does timedatectl do?
How do you use journalctl to investigate why a service failed to start?
What is cron, and how do you read a crontab schedule expression?
What is logrotate, and why is it important for long-running servers?
What is stored under /var/log, and what is the role of rsyslog?
What is the difference between cron, at, and systemd timers for scheduling tasks?
What is the purpose of the journald daemon compared to traditional syslog?
How does the find command work, and how do you combine it with xargs to act on the results?
How would you use grep, and what is the difference between grep, egrep, and using -E for extended regex?
What is awk and what kind of text-processing problems is it best suited for?
What is sed used for, and can you explain a basic substitution command?
What is the difference between the tar, gzip, and zip formats, and why is tar often combined with gzip?
What advantages does LVM provide over using raw partitions directly?
What is disk quota management on Linux, and how would you limit how much space a user can consume?
What is LVM, and how do physical volumes, volume groups, and logical volumes relate to each other?
What is software RAID via mdadm, and how do RAID levels 0, 1, 5, and 10 differ in terms of redundancy and performance?
What is the process of adding and enabling swap space using mkswap and swapon?
Kernel Modules Tuning & Devices
What are loadable kernel modules, and what do lsmod, modprobe, and rmmod do?
What is dmesg and the kernel ring buffer, and what kind of information does it contain?
What is sysctl, and how does it let you tune kernel parameters at runtime versus persistently?
What is udev, and how does it manage device files under /dev dynamically?