Linux Complete Interview Pack 3: Linux Interview Questions Commonly Asked at TCS, Infosys, Accenture, Wipro, Amazon, Google and Red Hat, with RHCSA-Style Tasks

A typical answer: check monitoring alerts and tickets, handle user and permission requests, patching, disk and filesystem issues, backups, service restarts, log checks, and change requests following ITIL with approvals. Give one real example.

An incident is an unplanned outage or degradation to restore fast. A problem is the root cause behind one or more incidents. A change is a planned modification that goes through approval (CAB) with a rollback plan.

Acknowledge, join the bridge, check console or cloud status, ping and SSH, review recent changes, logs and resources, restore service first (restart, failover or rollback), keep stakeholders updated, then write the RCA.

A Service Level Agreement sets response and resolution times per priority, like P1 response in 15 minutes. Missing it can bring penalties, so tickets are tracked closely.

Take an approved change window, snapshot or backup, check free space, patch a test group first, run dnf update or yum update with security filters if required, reboot if the kernel changed, validate services, then roll out in batches.

dnf check-update or dnf updateinfo list security for pending; dnf history and rpm -qa --last for recent installs. On Ubuntu, apt list --upgradable and /var/log/apt/history.log.

Account status (passwd -S, chage -l, faillock or pam_tally), shell in /etc/passwd, home folder permissions, SSH key permissions, AllowUsers in sshd_config, disk full on /home, and the auth log (/var/log/secure or auth.log).

faillock --user asha --reset clears failed attempts; passwd -u asha or usermod -U asha unlocks the password; chage -E -1 asha removes an expiry.

If on LVM with free space in the VG: lvextend -r -L +10G /dev/vg/lv. If not, add a disk, pvcreate, vgextend, then lvextend -r. Before that, clear safe junk like old logs.

Hard mounts keep retrying when the server is down, so apps hang but data stays safe. Soft mounts return an error after retries, which can corrupt writes. Hard is the usual default.

crontab -e and add 0 2 * * 0 /opt/scripts/weekly.sh. Fields are minute, hour, day of month, month, day of week.

crontab runs jobs repeatedly on a schedule; at runs a job once at a set time (echo cmd | at 23:00).

xfs is the RHEL default, scales well for large files and parallel IO, can grow but cannot shrink. ext4 is the Ubuntu default, can grow and shrink offline, and is very mature.

0 poweroff.target, 1 rescue.target, 3 multi-user.target, 5 graphical.target, 6 reboot.target. Check with systemctl get-default and change with set-default.

ss -tulpn | grep :8080 or lsof -i :8080. fuser 8080/tcp also shows the PID.

A soft link is a pointer to a path, works across filesystems and breaks if the target is deleted. A hard link is another name for the same inode, same filesystem only, and survives deletion of the other name.

An inode stores a file's metadata and data block pointers. If inodes run out (df -i shows 100 percent), you cannot create files even with free space; usually caused by millions of small files like session or cache files.

lscpu for CPU, free -h for memory, lsblk and fdisk -l for disks, lspci and lsusb for devices, dmidecode for model and serial, and ip link for NICs.

Combining two network cards into one logical interface for redundancy (active-backup, mode 1) or extra throughput (802.3ad LACP, mode 4). Configured with nmcli on RHEL.

It lists filesystems to mount at boot. A wrong entry can drop the server into emergency mode. Test with mount -a and findmnt --verify before rebooting, and use nofail for non-critical disks.

tar -czpf /backup/etc-$(date +%F).tgz /etc creates it with permissions; tar -tzf lists contents; tar -xzpf file -C / restores. Always test restores.

rpm installs single package files and does not resolve dependencies. yum and dnf fetch from repositories and resolve dependencies automatically.

Copy RPMs or mount the ISO, run createrepo on the folder if needed, and add a .repo file in /etc/yum.repos.d with baseurl=file:///path and gpgcheck settings, then dnf clean all and dnf repolist.

free -h and vmstat 1. Look at the available column, not free. Little or steady swap is fine; constant swap in and out (si/so in vmstat) means memory pressure.

BIOS or UEFI, then GRUB2 loads the kernel and initramfs, the kernel starts systemd as PID 1, systemd mounts filesystems and starts units up to the default target, then the login prompt.

A mandatory access control system using labels on files and processes. getenforce and sestatus show the mode: enforcing, permissive or disabled. Change permanently in /etc/selinux/config.

visudo -f /etc/sudoers.d/asha and add asha ALL=(root) /usr/bin/systemctl restart nginx. Check with sudo -l -U asha.

kill sends SIGTERM (15) so the process can clean up. kill -9 sends SIGKILL which cannot be caught, used as a last resort. pkill and killall send signals by name.

who and w for current users, last for login history from wtmp, lastb for failed attempts, and lastlog for each user's last login.

DNS lookup (cache, resolver, root, TLD, authoritative), TCP handshake, TLS handshake with certificate check, HTTP request through load balancers to the server, the app builds a response, and the browser renders HTML and fetches more assets. Go deeper on any layer they ask.

The shell parses the line, searches PATH, calls fork to make a child and execve to load /bin/ls. ls calls openat and getdents64 on the folder, stat calls for details, write to stdout, then exit. The shell waits with wait4 and reads the status.

Use a method like USE (utilization, saturation, errors) per resource: uptime for load, top or htop for CPU and steal, vmstat for run queue and swap, iostat -xz for disk await, free for memory, ss and sar -n DEV for network, dmesg for errors, then drill into the busy process with pidstat, strace or perf.

ls -l /proc/PID/fd or lsof -p PID. Deleted but open files show with lsof +L1; space is freed only when the process closes them or restarts.

Each process sees its own virtual address space mapped to physical pages by page tables. A minor fault maps a page already in RAM; a major fault reads it from disk. The kernel uses demand paging, copy-on-write and swap.

An agent on each host (Fluent Bit, Vector or CloudWatch agent) ships structured logs to a central buffer (Kafka or Kinesis), into storage and search (OpenSearch, Loki or S3 with Athena), with retention tiers, parsing at the edge, sampling for noisy logs, and alerts on patterns.

Filter by time with awk on the timestamp or use journalctl --since '1 hour ago', extract the IP field, then sort -u | wc -l. For huge logs, use LC_ALL=C and a single awk pass with an array.

Both are tasks created with clone. Threads share memory, file descriptors and signal handlers with their group; processes have separate address spaces. ps -eLf or top -H shows threads.

Sequence numbers, acknowledgements, retransmission on timeout or duplicate ACKs, sliding windows for flow control and congestion control algorithms like CUBIC or BBR.

mtr for per-hop loss over time, ping with large and do-not-fragment packets for MTU, ss -ti for retransmits, ethtool -S and ip -s link for NIC errors, tcpdump on both sides to compare, and check conntrack table limits and security group or firewall rules.

Canary a few hosts, watch metrics, then roll out in waves with automatic pause on errors, drain traffic before reboot, keep the old kernel in GRUB for fallback, and use immutable images where possible.

Multiple instances across availability zones behind a load balancer with health checks, autoscaling, stateless app servers with sessions in Redis, a managed database with replicas, config from a central store, and monitoring with alerts on SLOs.

iotop -o or pidstat -d 1 shows per-process reads and writes, iostat -xz 1 shows which device is busy, and /proc/PID/io gives cumulative counters.

Namespaces isolate what a process sees (pid, net, mnt, uts, ipc, user). Cgroups limit and measure what it uses (CPU, memory, IO, pids). A container is a process with both plus a layered root filesystem.

Use STAR, stress what you did, how you communicated, how fast service came back, the root cause, and what changed after (automation, alerts, runbooks). Amazon-style interviews often map this to leadership principles like ownership.

Fedora is the fast upstream community distro. CentOS Stream sits just ahead of the next RHEL minor release. RHEL is the supported enterprise product. Rocky and AlmaLinux are community rebuilds that aim for RHEL compatibility.

subscription-manager register --username ... then subscription-manager repos --list-enabled. On newer RHEL with simple content access, registration alone enables BaseOS and AppStream.

BaseOS holds core OS packages. AppStream holds applications and runtimes, some offered as module streams (like nodejs:18 or :20) so you can pick a version. dnf module list shows them.

Check ausearch -m AVC -ts recent or journalctl -t setroubleshoot, run sealert -a /var/log/audit/audit.log for advice, fix labels with restorecon or semanage fcontext, set booleans with setsebool -P, or add ports with semanage port.

Stratis is a local storage manager for pooled, thin-provisioned filesystems on top of XFS. VDO adds deduplication and compression; in RHEL 9 it is managed through LVM (lvcreate --type vdo).

nmcli con mod eth0 ipv4.method manual ipv4.addresses 192.168.1.50/24 ipv4.gateway 192.168.1.1 ipv4.dns 8.8.8.8 then nmcli con up eth0.

Zones group interfaces or sources with a trust level and allowed services. Rich rules add fine-grained rules like allowing a port only from one subnet. Use --permanent and --reload to persist.

An agentless automation tool over SSH using YAML playbooks and idempotent modules. Red Hat ships Ansible Automation Platform and RHEL system roles for common tasks like timesync, firewall and SELinux.

tuned applies performance profiles like throughput-performance, virtual-guest or latency-performance. tuned-adm recommend suggests one and tuned-adm profile sets it.

Run sos report (sosreport on older releases) to gather configs, logs and command outputs into an archive, then attach it to the support case.

Podman is daemonless and rootless by default: podman run -d -p 8080:80 nginx. podman generate systemd or Quadlet files run containers as systemd services.

kdump reserves memory for a second kernel that saves a vmcore when the main kernel crashes, so engineers can find the cause with the crash tool.

Each fix is published as an RHSA advisory with CVEs and severity. dnf updateinfo list security shows pending ones and dnf update --advisory RHSA-... applies one. Insights can flag risk across a fleet.

RHCSA tests core admin skills hands-on: users, storage, LVM, networking, SELinux, services, containers and boot repair. RHCE (on RHEL 8 and 9) focuses on automating those tasks with Ansible.

Fixes and features go into the upstream project first so everyone benefits and the code is maintained by the community. Interviewers may ask about any open source work you have done.

Interrupt GRUB, add rd.break to the linux line, then remount and relabel.

# at GRUB press e, add rd.break at end of linux line, Ctrl+x
mount -o remount,rw /sysroot
chroot /sysroot
passwd root
touch /.autorelabel
exit; exit

Use nmcli and hostnamectl so settings survive reboot.

nmcli con mod 'Wired connection 1' ipv4.method manual ipv4.addresses 172.25.250.11/24 ipv4.gateway 172.25.250.254 ipv4.dns 172.25.250.254
nmcli con up 'Wired connection 1'
hostnamectl set-hostname servera.lab.example.com

Create a .repo file with both sections and verify.

cat > /etc/yum.repos.d/lab.repo <<EOF
[BaseOS]
name=BaseOS
baseurl=http://content.example.com/rhel9/BaseOS
gpgcheck=0
[AppStream]
name=AppStream
baseurl=http://content.example.com/rhel9/AppStream
gpgcheck=0
EOF
dnf repolist

Use groupadd, useradd -G and -s /sbin/nologin, then set passwords.

groupadd sysadms
useradd -G sysadms natasha
useradd -G sysadms harry
useradd -s /sbin/nologin sarah
for u in natasha harry sarah; do echo trootent | passwd --stdin $u; done

Set group ownership, 2770 mode for setgid.

mkdir -p /common/admin
chgrp sysadms /common/admin
chmod 2770 /common/admin
ls -ld /common/admin

Use a sudoers.d file and validate it.

echo '%sysadms ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/sysadms
chmod 440 /etc/sudoers.d/sysadms
visudo -cf /etc/sudoers.d/sysadms

Edit login.defs for new users; chage for existing ones.

sed -i 's/^PASS_MAX_DAYS.*/PASS_MAX_DAYS 60/' /etc/login.defs
chage -M 60 natasha
chage -l natasha

Use crontab -u.

crontab -u harry -e
# add: */2 * * * * logger 'EX200 in progress'
crontab -u harry -l

Edit chrony.conf and restart chronyd.

echo 'server classroom.example.com iburst' >> /etc/chrony.conf
systemctl enable --now chronyd; systemctl restart chronyd
chronyc sources -v

Add the port to the http_port_t type and the firewall.

sed -i 's/^Listen 80/Listen 82/' /etc/httpd/conf/httpd.conf
semanage port -a -t http_port_t -p tcp 82
firewall-cmd --permanent --add-port=82/tcp; firewall-cmd --reload
systemctl enable --now httpd; curl -s localhost:82

Add a persistent fcontext rule and apply it.

mkdir -p /web/html; echo hi > /web/html/index.html
semanage fcontext -a -t httpd_sys_content_t '/web(/.*)?'
restorecon -Rv /web
ls -Zd /web/html

Partition, PV, VG with -s 16M, LV, mkfs, fstab by UUID.

pvcreate /dev/vdb1
vgcreate -s 16M datastore /dev/vdb1
lvcreate -n database -L 512M datastore
mkfs.ext4 /dev/datastore/database
mkdir -p /mnt/database
echo "UUID=$(blkid -s UUID -o value /dev/datastore/database) /mnt/database ext4 defaults 0 0" >> /etc/fstab
systemctl daemon-reload; mount -a; df -h /mnt/database

lvresize with -r grows the filesystem too.

lvs
lvresize -r -L 300M /dev/vg0/lv0
df -h | grep lv0

Create a partition of type swap, mkswap, add to fstab, swapon.

parted /dev/vdb mkpart primary linux-swap 1025MiB 1537MiB
mkswap /dev/vdb2
echo "UUID=$(blkid -s UUID -o value /dev/vdb2) none swap defaults 0 0" >> /etc/fstab
swapon -a; swapon --show

Add an indirect map in auto.master.d.

dnf install -y autofs nfs-utils
echo '/rhome /etc/auto.rhome' > /etc/auto.master.d/rhome.autofs
echo 'remoteuser1 -rw,sync servera:/rhome/remoteuser1' > /etc/auto.rhome
systemctl enable --now autofs
ls /rhome/remoteuser1

find with -user and cp --parents.

mkdir -p /root/findfiles
find / -user jacques -type f -exec cp -a --parents {} /root/findfiles/ \; 2>/dev/null

grep and redirect.

grep -w ich /usr/share/xml/iso-codes/iso_639_3.xml > /root/lines
wc -l /root/lines

tar with -j for bzip2.

tar -cjvf /root/backup.tar.bz2 /usr/local
tar -tjf /root/backup.tar.bz2 | head

Install and enable tuned, then apply the recommendation.

dnf install -y tuned; systemctl enable --now tuned
tuned-adm profile $(tuned-adm recommend)
tuned-adm active

Create the folder or set Storage=persistent and restart journald.

mkdir -p /var/log/journal
sed -i 's/^#\?Storage=.*/Storage=persistent/' /etc/systemd/journald.conf
systemctl restart systemd-journald
journalctl --list-boots

systemctl set-default and isolate.

systemctl set-default multi-user.target
systemctl isolate multi-user.target
systemctl get-default

Run it with podman, generate a user unit and enable linger.

su - athena
podman login registry.lab.example.com
podman run -d --name web -p 8080:8080 -v ~/web:/var/www/html:Z registry.lab.example.com/rhel9/httpd
mkdir -p ~/.config/systemd/user; cd ~/.config/systemd/user
podman generate systemd --name web --files --new
systemctl --user daemon-reload; systemctl --user enable --now container-web
loginctl enable-linger athena

Edit sshd_config, validate and restart.

sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
echo 'AllowUsers root harry' >> /etc/ssh/sshd_config
sshd -t && systemctl restart sshd

Use top or ps sorted by CPU, kill with TERM, renice.

ps -eo pid,comm,%cpu --sort=-%cpu | head -3
kill <PID>
renice -n 10 -p <OTHER_PID>

find with size and perm options.

cat > /usr/local/bin/myfiles <<'EOF'
#!/bin/bash
find /usr -type f -size +30k -size -50k -perm -4000 > /root/myfiles
EOF
chmod +x /usr/local/bin/myfiles; myfiles; cat /root/myfiles

No. They are typical, commonly reported questions from public candidate experiences. Real interviews vary by team and interviewer.

Not always, but it is often listed as a plus and helps in practical rounds.

No. They are practice tasks in the same style. The real exam content is confidential.

RHEL with a free developer subscription, or Rocky Linux or AlmaLinux 9.

For SRE, DevOps and infrastructure roles, yes, often with deep internals and troubleshooting.

Very, especially at product companies. Prepare 4 to 6 STAR stories.

Say so, relate it to a similar tool you know, and explain how you would learn it.

For service and support roles it commonly comes up: incident, problem, change and SLA basics.

The highest priority incident, usually a full production outage.

systemctl enable name.

getenforce.

pvs, vgs and lvs.

firewall-cmd --permanent then --reload.

rd.break at GRUB, remount sysroot rw, chroot, passwd, touch /.autorelabel.

Daemonless and rootless by default, with systemd integration.

Collects configs, logs and command outputs for support.

fork, execve, openat, getdents64, stat, write, exit and wait4 in the shell.

Canary, waves with automatic pause, drain before reboot, keep old kernel, and metrics gates.

mtr, MTU tests, ss -ti retransmits, NIC counters, tcpdump both ends, conntrack limits.

STAR with timeline, communication, fix, RCA and lasting improvements.