Skip to content

Linux Interview Preparation

Curated from DevOps interview sources and the Linux course lesson banks, deduplicated, and edited for REBASH Academy. Every question includes a model answer. Answer out loud first, then reveal it. Prefer judgement and verification over memorised lists. The From the Linux course section copies every lesson interview question, grouped as Beginner, Intermediate, and Architect Level, each with a model answer.

How to practise

  1. Answer in two minutes without notes
  2. Name the first three commands or checks you would run
  3. Call out a failure mode and a rollback
  4. Tie the answer to least privilege and blast radius

Core concepts

1. Add 50GB to /opt using LVM without any downtime. What are the steps?

Reveal answer

In short: Grow the LVM volume that backs /opt online — add capacity, extend the LV, then grow the filesystem without unmounting.

Key points

  • Confirm filesystem and LV with df -hT /opt, lsblk, and lvs.
  • If needed: pvcreate a new disk, vgextend, then lvextend -L +50G.
  • Grow online: XFS → xfs_growfs /opt; ext4 → resize2fs.
  • Verify with df -h /opt.

Try this

  • lsblk
  • sudo lvs
  • sudo lvextend -L +50G /dev/<vg>/<lv>
  • sudo xfs_growfs /opt

Trap

  • Extending the wrong LV — or shrinking without shrinking the filesystem first — destroys data.

2. What is LVM, and why is it useful in DevOps?

Reveal answer

In short: Logical Volume Manager (LVM) pools disks so you can resize volumes without repartitioning.

Key points

  • Physical Volumes feed a Volume Group; Logical Volumes are carved from the VG.
  • DevOps value: grow data volumes during incidents without rebuilding hosts.
  • Snapshots help short rollback windows before risky changes.
  • Daily tools: pvs, vgs, lvs, lvextend.

Try this

  • sudo pvs && sudo vgs && sudo lvs

Trap

  • Never shrink an LV before shrinking the filesystem — order matters.

3. What is the difference between a process and a thread?

Reveal answer

In short: A process owns its address space and credentials; a thread shares that space with sibling threads.

Key points

  • Threads keep their own stack/registers but share memory and file descriptors.
  • Threads are cheaper; shared memory needs locks to avoid races.
  • Containers isolate processes — threads alone are not a security boundary.

Try this

  • ps -eLf | head

Trap

  • Claiming threads provide isolation like processes or containers.

4. What are runlevels in Linux, and how do they affect system startup?

Reveal answer

In short: Classic SysV runlevels were numbered boot states; systemd maps them to targets.

Key points

  • Common map: 0 halt, 1 rescue, 3 multi-user text, 5 graphical, 6 reboot.
  • Today: multi-user.target ≈ 3, graphical.target ≈ 5.
  • The default target decides what starts after boot.

Try this

  • systemctl get-default
  • systemctl list-units --type=target

Trap

  • Changing the default target without console/serial access can strand the host.

5. Explain the difference between a process and a daemon in Linux.

Reveal answer

In short: Every running program is a process; a daemon is a long-running background process, usually under systemd.

Key points

  • Daemons typically start at boot with no controlling terminal.
  • Prefer unit files (Type=simple/notify) over legacy double-fork PID files.
  • Examples: sshd, chronyd, containerd.

Try this

  • systemctl status ssh

Trap

  • Calling every background job a daemon without saying what restarts it on crash.

6. What is the purpose of iptables in Linux?

Reveal answer

In short: iptables configures Netfilter packet filter rules in the kernel.

Key points

  • Used to allow SSH, block ranges, and DNAT service ports.
  • Many hosts now use nftables, firewalld, or ufw as the front end.
  • Cloud security groups sit in front — host firewall is still defence in depth.

Try this

  • sudo iptables -S
  • sudo nft list ruleset

Trap

  • Flushing firewall rules over SSH without a safe allow for your session.

7. What is SSH and how is it useful in a DevOps context?

Reveal answer

In short: Secure Shell (SSH) provides encrypted remote login, commands, and file copy — bootstrap and break-glass access.

Key points

  • Prefer key-based auth (ed25519) and jump hosts / Session Manager.
  • Harden with PasswordAuthentication no and PermitRootLogin no.
  • Always run sshd -t before reload.

Try this

  • sudo sshd -t
  • journalctl -u ssh -e

Trap

  • Baking private keys into images or committing them to Git.

8. How do servers get connected in Linux? explain?

Reveal answer

In short: Servers connect over IP: addresses on interfaces, routes for next hops, sockets for listeners.

Key points

  • Check ip addr, ip route, then ss -lntp.
  • Security groups and host firewalls must allow the port.
  • Private subnets need correct routes and peering/VPN design.

Try this

  • ip addr
  • ip route
  • ss -lntp

Trap

  • Opening more firewall ports when the real issue is nothing listening.

9. What is the role of cron in Linux?

Reveal answer

In short: cron runs commands on a calendar schedule for the system or a user.

Key points

  • Common uses: backups, cert helpers, log cleanup.
  • Use absolute paths — cron’s environment is minimal.
  • systemd timers are often clearer for modern services.

Try this

  • crontab -e
  • */15 * * * * /usr/local/bin/backup.sh >>/var/log/backup.log 2>&1

Trap

  • Scripts that work interactively fail in cron for missing PATH or wrong timezone.

10. Explain how Linux file permissions work (rwx).

Reveal answer

In short: Permissions are owner/group/others triples: read (r=4), write (w=2), execute (x=1).

Key points

  • rwxr-xr-x is mode 755.
  • On directories, x means traverse — needed for cd.
  • Know setuid, setgid, and the sticky bit on /tmp.

Try this

  • ls -l file
  • stat -c '%a %A %n' file

Trap

  • World-writable secrets or scripts (777).

11. What is the difference between kill and kill -9?

Reveal answer

In short: kill sends SIGTERM by default; kill -9 sends SIGKILL, which cannot be caught.

Key points

  • TERM lets the process clean up; KILL tears it down immediately.
  • Prefer TERM → wait → escalate.
  • Confirm PID and blast radius first.

Try this

  • kill <pid>
  • kill <pid>; sleep 5; kill -9 <pid>

Trap

  • Reaching for -9 first and leaving half-written state behind.

12. Explain how you can schedule a one-time task in Linux.

Reveal answer

In short: For a one-time delayed job use at, not cron.

Key points

  • echo cmd | at now + 2 hours or at 23:30.
  • Use absolute paths; environment is limited.
  • Cloud teams often prefer SSM maintenance windows or CI for audit trails.

Try this

  • echo '/usr/local/bin/patch.sh' | at now + 2 hours
  • atq

Trap

  • Assuming atd is installed and enabled on every image.

13. Explain the purpose of the chmod command in Linux.

Reveal answer

In short: chmod changes who can read, write, or execute a path.

Key points

  • Symbolic (u+x) or numeric (600, 755) forms both work.
  • Set modes after unpacking artefacts in pipelines.
  • umask affects new files; chmod fixes existing ones.

Try this

  • chmod u+x deploy.sh
  • chmod 600 secrets.env

Trap

  • chmod -R 777 as a troubleshooting step.

Scenarios and troubleshooting

14. How do you troubleshoot 1/0 wait issues on Linux?

Reveal answer

In short: High I/O wait means CPUs are idle waiting on disks — find the hot device and noisy process.

Key points

  • Confirm with vmstat 1 and iostat -xz 1.
  • Use iotop -o to see who is writing.
  • Mitigate with IOPS, quieter jobs, or less memory thrashing.

Try this

  • vmstat 1
  • iostat -xz 1
  • sudo iotop -o

Trap

  • Tuning CPU when steal/iowait are the real bottleneck.

15. What is a kernel panic, and how would you troubleshoot it?

Reveal answer

In short: A kernel panic is an unrecoverable kernel fault; collect evidence before you reboot again.

Key points

  • Capture serial/console output and prior boot logs.
  • Check tainted flags and recent driver/kernel changes.
  • Boot a previous kernel; enable kdump for next time.

Try this

  • journalctl -k -b -1
  • kdumpctl status

Trap

  • Rebooting without saving console output — you lose the smoking gun.

16. How would you troubleshoot a Linux system that is running out of memory?

Reveal answer

In short: Treat out-of-memory as evidence: find top consumers, check cgroup limits, then fix leak or capacity.

Key points

  • Search OOM killer lines in dmesg/journalctl -k.
  • Focus on available memory — page cache is normal.
  • Capture process list before restarting the offender.

Try this

  • free -h
  • ps aux --sort=-%mem | head
  • journalctl -k | grep -i oom

Trap

  • Adding huge swap as the only fix — latency collapses before stability returns.

17. How to troubleshoot the issue and what will be checked during the process?

Reveal answer

In short: Use a structured loop: symptom → blast radius → recent change → one hypothesis → verify.

Key points

  • Define impact: who, what error, since when.
  • Check CPU, memory, disk, network, failed units, recent deploys.
  • Change one thing at a time and keep a timeline.

Try this

  • uptime; free -h; df -h
  • systemctl --failed
  • journalctl -p err -b --no-pager | tail -50

Trap

  • Changing three things at once so you never know what fixed it.

18. How will you troubleshoot if a system goes down in Linux - tell the commands?

Reveal answer

In short: If the host is unreachable, start out-of-band: cloud status, serial/SSM, then OS recovery.

Key points

  • Verify power and status checks before chasing SSH.
  • Use serial console or Session Manager; GRUB previous kernel if looping.
  • With a shell: previous boot logs, failed units, network, listeners.

Try this

  • journalctl -b -1
  • systemctl --failed
  • ip a; ss -lntp

Trap

  • Opening SSH to 0.0.0.0/0 as the recovery plan.

19. How would you schedule a task to run every 15 minutes in windows using powershell and linux with cron?

Reveal answer

In short: Linux: cron */15 * * * *; Windows: a Scheduled Task with a 15-minute repetition.

Key points

  • Linux: absolute paths and redirected logs in crontab or /etc/cron.d/.
  • Windows: Register-ScheduledTask with a repeating trigger.
  • Call out timezone and least-privilege run-as account.

Try this

  • */15 * * * * /usr/local/bin/task.sh >>/var/log/task.log 2>&1
  • Register-ScheduledTask with a 15-minute RepetitionInterval

Trap

  • Relative paths and interactive-only environment variables on either platform.

20. How would you deal with high CPU usage on a Linux server?

Reveal answer

In short: Prove high CPU with top/htop, split user/system/iowait/steal, then profile the hot PID.

Key points

  • Sort processes by CPU; inspect threads with top -H -p <pid>.
  • Steal time often means noisy neighbours or an undersized instance.
  • Capture stacks before restarting.

Try this

  • ps aux --sort=-%cpu | head
  • top -H -p <pid>

Trap

  • Killing the top PID without knowing blast radius.

21. How would you optimize a Linux system for performance?

Reveal answer

In short: Optimise from a measured bottleneck — CPU, memory, disk, or network — not random sysctl lore.

Key points

  • Fix the application before exotic kernel knobs.
  • Keep systems patched; use sensible mount options and tuned where relevant.
  • Disable unused services; right-size disk IOPS.

Try this

  • sar -u 1 5
  • iostat -xz 1

Trap

  • Copy-pasting “performance sysctl” packs without baseline and rollback.

Practice questions

22. How you connect to private instances when the SSH connection is not working?

Reveal answer

In short: When SSH to a private instance fails, use Session Manager, serial console, or a jump host.

Key points

  • AWS: SSM, EC2 serial console, or bastion with ProxyJump.
  • GCP IAP / Azure Bastion are the usual equivalents.
  • Fix security groups, routes, and sshd from the console.

Try this

  • aws ssm start-session --target i-...
  • ssh -J bastion user@private

Trap

  • Leaving a temporary world-open SSH rule after the incident.

23. You’re locked out via SSH with no root access. How do you recover?

Reveal answer

In short: Without SSH or root, recover via rescue: attach the root volume to a healthy helper VM and fix files.

Key points

  • Stop the instance, detach root, attach to rescue, mount, repair keys/sshd_config.
  • Sync, detach, reattach, boot, verify.
  • Prefer SSM/serial patterns so this is rare.

Try this

  • sudo mount /dev/xvdf1 /mnt
  • sudo chroot /mnt

Trap

  • Editing the wrong volume or reattaching before a clean unmount.

24. In Linux, how do you attach and detach a filesystem?

Reveal answer

In short: Attach with mount (persist via UUID in /etc/fstab); detach with umount when idle.

Key points

  • Cloud: attach the block device at the API, then mount in the guest.
  • If busy, find holders with lsof/fuser before forcing.
  • findmnt shows the live picture.

Try this

  • sudo mount /dev/nvme1n1p1 /mnt/data
  • sudo umount /mnt/data

Trap

  • Unmounting a volume the application is still writing to.

25. How do you print the last 15 lines of a file in Linux?

Reveal answer

In short: Print the last 15 lines with tail -n 15 file.

Key points

  • tail -f follows a growing log.
  • Prefer tail over loading huge files into editors.
  • head reads from the start instead.

Try this

  • tail -n 15 /var/log/syslog
  • tail -f /var/log/syslog

Trap

  • cat file | tail — useless use of cat on large logs.

26. Diff between mount and directories in Linux?

Reveal answer

In short: mount attaches a filesystem at a path; a directory is only a name until something is mounted there.

Key points

  • After mount, /mnt/data shows the other filesystem’s root.
  • findmnt/df show what sits where.
  • Bind mounts and tmpfs are mounts too.

Try this

  • findmnt
  • df -hT

Trap

  • Writing into a mount point while the volume is unmounted — data vanishes when you mount later.

27. How do you install a specific version of a package in Linux?

Reveal answer

In short: Pin the version in the package manager: apt install pkg=version or dnf install pkg-version.

Key points

  • List candidates with apt-cache policy or dnf list --showduplicates.
  • Lock versions in images and config management.
  • Use distro hold/versionlock features for critical packages.

Try this

  • apt-cache policy nginx
  • sudo apt-get install nginx=1.24.*

Trap

  • Pinning one package while letting dependencies float wildly.

28. How do you monitor system performance in Linux?

Reveal answer

In short: Watch CPU, memory, disk, and network — plus saturation and errors, not just averages.

Key points

  • Live tools: top, vmstat, iostat, ss, sar.
  • Long-term: node exporter + Prometheus/Grafana or cloud agents.
  • Alert on user-visible latency and errors.

Try this

  • uptime
  • free -h
  • iostat -xz 1

Trap

  • Alerting only on CPU% while disks are saturated.

29. How do you find running processes?

Reveal answer

In short: List processes with ps, pgrep, or interactive top/htop.

Key points

  • ps aux / ps -ef for snapshots.
  • systemctl status for supervised services.
  • Use lsof when you need open files/sockets.

Try this

  • ps aux --sort=-%cpu | head
  • pgrep -a nginx

Trap

  • Killing lookalike PIDs from a careless grep.

30. How to create a user without an SSH access?

Reveal answer

In short: Create a system user with a non-login shell and no SSH authorized keys.

Key points

  • useradd --system --shell /usr/sbin/nologin … (flags vary by distro).
  • Do not create authorized_keys for that account.
  • Grant only the groups/ACLs the service needs.

Try this

  • sudo useradd --system --shell /usr/sbin/nologin appuser
  • getent passwd appuser

Trap

  • Giving service accounts /bin/bash “for convenience”.

31. Write a shell script where you have one virtual machine ubuntu1, auto ssh enabled, ssh -i for private key, directory path /nobackup to be copied in another VM?

Reveal answer

In short: Copy /nobackup with rsync over SSH using an identity file and automation-friendly SSH options.

Key points

  • Prefer rsync -aHAX over ad-hoc recursive scp.
  • Pin ssh -i and log exit codes.
  • Schedule with cron/systemd using absolute paths.

Try this

  • rsync -aHAX -e 'ssh -i /path/key' /nobackup/ user@vm2:/nobackup/

Trap

  • Disabling host-key checks permanently or embedding passwords in scripts.

32. How can you manage software packages in Ubuntu/Debian-based systems?

Reveal answer

In short: On Ubuntu/Debian, use Advanced Package Tool (APT) to update indexes and install/remove packages.

Key points

  • apt update then apt install/remove/purge.
  • Prefer configuration management for desired state.
  • Use unattended upgrades carefully with change control.

Try this

  • sudo apt update
  • sudo apt install -y curl

Trap

  • Blind apt upgrade on production without a rollback path.

33. How to set a CPU and memory limit in Linux machine?

Reveal answer

In short: Limit CPU/memory with cgroups — usually systemd unit settings or container limits.

Key points

  • systemd: CPUQuota= and MemoryMax= in a drop-in.
  • ulimit is easy to lose; prefer unit/cgroup limits.
  • In Kubernetes/Docker, set workload requests/limits.

Try this

  • systemctl show <unit> -p MemoryMax -p CPUQuota

Trap

  • Limits so low the service OOM-loops forever.

34. When you run a module like yum or apt and get “command not found,” what’s the reason?

Reveal answer

In short: yum/apt “command not found” means the wrong package manager for that OS — or a minimal image without one.

Key points

  • Debian-like → apt; RHEL-like → dnf/yum.
  • Many containers omit package managers on purpose.
  • In Ansible, branch on OS facts instead of hard-coding yum.

Try this

  • command -v apt-get yum dnf
  • cat /etc/os-release

Trap

  • Installing yum on Ubuntu to paper over a bad playbook.

35. What types of file permissions exist in Linux?

Reveal answer

In short: Linux has standard rwx mode bits plus setuid, setgid, sticky — and optional Access Control Lists (ACLs).

Key points

  • Files and directories interpret execute differently.
  • getfacl/setfacl extend the basic triad.
  • chattr attributes are a separate mechanism.

Try this

  • ls -l
  • getfacl file

Trap

  • Misreading ACL masks as simple chmod failures.

36. How to find the mount point space of linux?

Reveal answer

In short: Check mount-point space with df -h /path (and df -i for inodes).

Key points

  • df -hT shows filesystem type and capacity.
  • du -xh finds heavy directories inside the mount.
  • Bind mounts can make “where is my space?” confusing — use findmnt.

Try this

  • df -hT
  • df -h /var
  • df -i

Trap

  • Cleaning the wrong mount because a bind mount hid the real disk.

37. If vm deployed in private subent how can you do patch updates like apt update?

Reveal answer

In short: Private-subnet VMs patch via NAT, proxy, VPC endpoints, or an internal package mirror — not a public IP.

Key points

  • Ensure egress to repositories or a pull-through cache.
  • Use patch manager / Ansible for controlled windows.
  • Air-gapped sites need an internal mirror.

Try this

  • curl -I https://archive.ubuntu.com
  • sudo apt update

Trap

  • Attaching a public IP “just for patching” and forgetting to remove it.

38. Whats ur organisation current cicd process and tools?

Reveal answer

In short: Describe your real flow: Git → CI build/test/scan → artefact → deploy → verify, with the tools you actually run.

Key points

  • Name VCS, CI, artefact store, and deploy mechanism (GitOps/Helm/Terraform).
  • Mention environments, approvals, and rollback.
  • Call out quality gates: tests and security scans.

Try this

  • Sketch: commit → CI → artefact → deploy → verify

Trap

  • Listing every buzzword tool you have never operated end-to-end.

39. How to check the linux process?

Reveal answer

In short: Inspect Linux processes with ps, pgrep, or systemctl status for units.

Key points

  • ps -ef for a full table; sort when triage needs it.
  • Follow child processes under supervisors.
  • Use /proc/<pid> for deep detail.

Try this

  • ps -ef | grep [n]ginx
  • systemctl status nginx

Trap

  • Trusting a fuzzy grep that matches the wrong process.

40. How to check load of linux machine?

Reveal answer

In short: Load average is runnable + uninterruptible tasks — always compare it with CPU count.

Key points

  • uptime + nproc give the first ratio.
  • High load with low CPU often means I/O wait.
  • Cross-check memory pressure and steal time in the cloud.

Try this

  • uptime
  • nproc
  • vmstat 1 5

Trap

  • Panicking at load 4 on an 8-vCPU machine without context.

41. How to kill the running process?

Reveal answer

In short: Stop a process with SIGTERM first; use SIGKILL only if it ignores you.

Key points

  • Prefer systemctl stop for supervised services.
  • Confirm PID ownership before signalling.
  • Escalate only after a short wait.

Try this

  • pgrep -a myapp
  • kill <pid>
  • systemctl stop myapp

Trap

  • Killing the supervisor/runtime instead of the worker.

42. How to check linux process without use of ps or top command?

Reveal answer

In short: Without ps/top, enumerate /proc/[0-9]* and read cmdline/status.

Key points

  • Each PID is a directory under /proc.
  • cmdline is null-separated — translate with tr.
  • /proc/loadavg still works for load.

Try this

  • ls /proc | grep -E '^[0-9]+$'
  • tr '\0' ' ' < /proc/1/cmdline; echo

Trap

  • Forgetting PID namespaces — inside a container /proc is a different view.

43. How do you check the free disk space in Linux?

Reveal answer

In short: Free disk space: df -h for mounts, du to find what used it.

Key points

  • Check inodes with df -i when bytes remain but creates fail.
  • du -xh /path | sort -h | tail finds heavy dirs.
  • Watch open-deleted files holding space until restart.

Try this

  • df -h
  • df -i
  • du -xh /var | sort -h | tail

Trap

  • Deleting logs still held open by a process — space does not return yet.

44. What does the chmod 755 command do?

Reveal answer

In short: chmod 755 sets rwxr-xr-x: owner full; group and others read+execute.

Key points

  • Common for directories and shared scripts.
  • Wrong for secrets — use 600/640.
  • Octal: 7=rwx, 5=r-x.

Try this

  • chmod 755 deploy.sh
  • stat -c '%a %A' deploy.sh

Trap

  • Using 755 on private keys or .env files.

From the Linux course

Beginner

45. Why do ACLs exist?

Reveal answer

In short: Explain why ACLs exist exists: the failure it prevents and the trade-off you accept.

Key points

  • Name the risk or failure mode it reduces.
  • Call out the cost (complexity, latency, ops load).
  • Say when you would choose a different approach.

Try this

  • getfacl
  • setfacl -m
  • setfacl -x

Trap

  • Giving a definition without naming a command or file you would check.

46. Which command displays ACL entries?

Reveal answer

In short: Understand Access Control Lists (ACLs) - Configure user-specific permissions - Configure group-specific permissions - Set default ACLs - View ACL entries - Remove ACLs - Troubleshoot ACL issues -…

Key points

  • This removes all extended ACL entries while leaving the standard permissions intact.
  • The plus sign indicates that extended ACL entries exist.

Try this

  • getfacl
  • setfacl -m
  • setfacl -x

Trap

  • Giving a definition without naming a command or file you would check.

47. Which command adds an ACL?

Reveal answer

In short: Answer with judgement: what command adds ACL is, how you verify it, and what breaks if you get it wrong.

Key points

  • Lead with the operational definition interviewers expect.
  • Name a concrete verification command or metric.
  • Call out a common misconfiguration and blast radius.

Try this

  • getfacl
  • setfacl -m
  • setfacl -x

Trap

  • Giving a definition without naming a command or file you would check.

48. What is AppArmor?

Reveal answer

In short: AppArmor is best answered as: purpose → where it runs → how you inspect it on a live host.

Key points

  • Give a crisp definition of AppArmor in operational terms.
  • Say where it shows up (files, units, packets, cloud construct).
  • Name the first check you would run before changing anything.

Try this

  • systemctl reload apparmor
  • journalctl

Trap

  • Giving a definition without naming a command or file you would check.

49. What is an AppArmor profile?

Reveal answer

In short: Keep AppArmor enabled on supported systems. - Run production profiles in Enforce mode. - Use Complain mode only for testing and troubleshooting. - Review AppArmor logs regularly. - Reload profile…

Key points

  • The application is confined by an AppArmor profile that does not permit access to the configuration directory.
    1. Review AppArmor logs. 2. Update the application's profile. 3. Reload the profile.
  • bash sudo apparmor_parser -r /etc/apparmor.d/profile_name

Try this

  • systemctl reload apparmor
  • journalctl

Trap

  • Giving a definition without naming a command or file you would check.

50. What is the difference between Enforce and Complain modes?

Reveal answer

In short: Keep AppArmor enabled on supported systems. - Run production profiles in Enforce mode. - Use Complain mode only for testing and troubleshooting. - Review AppArmor logs regularly. - Reload profile…

Key points

  • Keep AppArmor enabled on supported systems. - Run production profiles in Enforce mode. - Use Complain mode only for testing and troubleshooting. - Review AppArmor logs regularly. - Reload profiles after making changes. - Follow the principle of least privilege. - Test profile changes before deploying them to production.

Try this

  • systemctl reload apparmor
  • journalctl

Trap

  • Giving a definition without naming a command or file you would check.

51. Which command displays AppArmor status?

Reveal answer

In short: Answer with judgement: what command displays AppArmor status is, how you verify it, and what breaks if you get it wrong.

Key points

  • Lead with the operational definition interviewers expect.
  • Name a concrete verification command or metric.
  • Call out a common misconfiguration and blast radius.

Try this

  • systemctl reload apparmor
  • journalctl

Trap

  • Giving a definition without naming a command or file you would check.

52. What does APT stand for?

Reveal answer

In short: APT stand is best answered as: purpose → where it runs → how you inspect it on a live host.

Key points

  • Give a crisp definition of APT stand in operational terms.
  • Say where it shows up (files, units, packets, cloud construct).
  • Name the first check you would run before changing anything.

Try this

  • apt update
  • apt upgrade
  • apt full-upgrade

Trap

  • Giving a definition without naming a command or file you would check.

53. Which Linux distributions use APT?

Reveal answer

In short: APT (Advanced Package Tool) is the default package management system used by Debian, Ubuntu, and many Debian-based Linux distributions. It simplifies installing, updating, upgrading, removing, and …

Key points

  • Always run apt update before installing packages. - Regularly apply package updates and security fixes. - Remove unused dependencies with apt autoremove. - Use trusted repositories only. - Review packages before installing them on production systems.
  • text APT Command │ ▼ Package Repository │ ▼ Download Package │ ▼ Resolve Dependencies │ ▼ Install Software │ ▼ Ready to Use

Try this

  • apt update
  • apt upgrade
  • apt full-upgrade

Trap

  • Giving a definition without naming a command or file you would check.

54. What is the difference between apt update and apt upgrade?

Reveal answer

In short: Understand package management - Learn how APT works - Install and remove software - Update package repositories - Upgrade installed packages - Search for packages - View package information - App…

Key points

  • ✅ apt update refreshes package information, while apt upgrade installs newer package versions.
  • ❌ Confusing apt update with apt upgrade.
  • Always run apt update before installing packages. - Regularly apply package updates and security fixes. - Remove unused dependencies with apt autoremove. - Use trusted repositories only. - Review packages before installing them on production systems.

Try this

  • apt update
  • apt upgrade
  • apt full-upgrade

Trap

  • Giving a definition without naming a command or file you would check.

55. How do you install a package?

Reveal answer

In short: Understand package management - Learn how APT works - Install and remove software - Update package repositories - Upgrade installed packages - Search for packages - View package information - App…

Key points

  • text APT Command │ ▼ Package Repository │ ▼ Download Package │ ▼ Resolve Dependencies │ ▼ Install Software │ ▼ Ready to Use
  • ✅ Avoid running apt install without updating the package index.
  • ❌ Running apt install without updating the package index.

Try this

  • apt update
  • apt upgrade
  • apt full-upgrade

Trap

  • Giving a definition without naming a command or file you would check.

56. What is Linux auditing?

Reveal answer

In short: Understand Linux auditing - Learn the Linux Audit Framework - Install and manage auditd - Create audit rules - Search audit logs - Investigate security events - Monitor critical files - Apply pro…

Key points

  • Linux auditing records security-related events, including:

Try this

  • journalctl
  • tail -f
  • systemctl status auditd

Trap

  • Giving a definition without naming a command or file you would check.

57. Where are audit logs stored?

Reveal answer

In short: Understand Linux auditing - Learn the Linux Audit Framework - Install and manage auditd - Create audit rules - Search audit logs - Investigate security events - Monitor critical files - Apply pro…

Key points

  • Audit logs help identify who, what, when, and how an event occurred.
  • ✅ Do not allow audit logs to grow without retention planning.
  • ❌ Allowing audit logs to grow without retention planning.

Try this

  • journalctl
  • tail -f
  • systemctl status auditd

Trap

  • Giving a definition without naming a command or file you would check.

58. Which command searches audit logs?

Reveal answer

In short: Understand Linux auditing - Learn the Linux Audit Framework - Install and manage auditd - Create audit rules - Search audit logs - Investigate security events - Monitor critical files - Apply pro…

Key points

  • Audit logs help identify who, what, when, and how an event occurred.
  • ✅ Do not allow audit logs to grow without retention planning.
  • ❌ Allowing audit logs to grow without retention planning.

Try this

  • journalctl
  • tail -f
  • systemctl status auditd

Trap

  • Giving a definition without naming a command or file you would check.

59. Why are backups important?

Reveal answer

In short: Explain why backups important exists: the failure it prevents and the trade-off you accept.

Key points

  • Name the risk or failure mode it reduces.
  • Call out the cost (complexity, latency, ops load).
  • Say when you would choose a different approach.

Try this

  • Name and run the primary verification command from this lesson topic.

Trap

  • Giving a definition without naming a command or file you would check.

60. What are the three common backup types?

Reveal answer

In short: Understand backup fundamentals - Learn different backup types - Create backups using Linux tools - Design backup strategies - Verify backup integrity - Automate backups - Understand disaster reco…

Key points

  • Understand backup fundamentals - Learn different backup types - Create backups using Linux tools - Design backup strategies - Verify backup integrity - Automate backups - Understand disaster recovery concepts - Apply backup best practices in production

Try this

  • Name and run the primary verification command from this lesson topic.

Trap

  • Giving a definition without naming a command or file you would check.

61. Which command creates a compressed archive?

Reveal answer

In short: Answer with judgement: what command creates compressed archive is, how you verify it, and what breaks if you get it wrong.

Key points

  • Lead with the operational definition interviewers expect.
  • Name a concrete verification command or metric.
  • Call out a common misconfiguration and blast radius.

Try this

  • Name and run the primary verification command from this lesson topic.

Trap

  • Giving a definition without naming a command or file you would check.

62. What is a backup strategy?

Reveal answer

In short: Backup Strategy — Protecting Linux Systems and Data

Key points

  • Backup Strategy — Protecting Linux Systems and Data

Try this

  • df -h
  • lsblk
  • crontab -l

Trap

  • Giving a definition without naming a command or file you would check.

63. What is the difference between full, incremental, and differential backups?

Reveal answer

In short: Faster restore than incremental backups

Key points

  • Faster restore than incremental backups

Try this

  • df -h
  • lsblk
  • crontab -l

Trap

  • Giving a definition without naming a command or file you would check.

64. Why should backups be tested?

Reveal answer

In short: Explain why should backups tested exists: the failure it prevents and the trade-off you accept.

Key points

  • Name the risk or failure mode it reduces.
  • Call out the cost (complexity, latency, ops load).
  • Say when you would choose a different approach.

Try this

  • df -h
  • lsblk
  • crontab -l

Trap

  • Giving a definition without naming a command or file you would check.

65. How do you create an array in Bash?

Reveal answer

In short: Understand Bash arrays - Create indexed arrays - Access array elements - Iterate through arrays - Add and remove elements - Determine array length - Use associative arrays - Apply arrays in produ…

Key points

  • bash echo ${#ARRAY[@]}

Try this

  • declare -A

Trap

  • Giving a definition without naming a command or file you would check.

66. How do you access the first element?

Reveal answer

In short: Walk through access first element as: assess → change → verify → rollback.

Key points

  • Start with the evidence you gather before touching production.
  • List the ordered steps and the privilege needed for each.
  • End with the verification and the rollback if the signal is wrong.

Try this

  • declare -A

Trap

  • Giving a definition without naming a command or file you would check.

67. How do you display all array elements?

Reveal answer

In short: Understand Bash arrays - Create indexed arrays - Access array elements - Iterate through arrays - Add and remove elements - Determine array length - Use associative arrays - Apply arrays in produ…

Key points

  • Understand Bash arrays - Create indexed arrays - Access array elements - Iterate through arrays - Add and remove elements - Determine array length - Use associative arrays - Apply arrays in production scripts

Try this

  • declare -A

Trap

  • Giving a definition without naming a command or file you would check.

68. What does Bash stand for?

Reveal answer

In short: Bash stand is best answered as: purpose → where it runs → how you inspect it on a live host.

Key points

  • Give a crisp definition of Bash stand in operational terms.
  • Say where it shows up (files, units, packets, cloud construct).
  • Name the first check you would run before changing anything.

Try this

  • ls

Trap

  • Giving a definition without naming a command or file you would check.

69. How do you create a variable?

Reveal answer

In short: Walk through create variable as: assess → change → verify → rollback.

Key points

  • Start with the evidence you gather before touching production.
  • List the ordered steps and the privilege needed for each.
  • End with the verification and the rollback if the signal is wrong.

Try this

  • ls

Trap

  • Giving a definition without naming a command or file you would check.

70. What is command substitution?

Reveal answer

In short: Understand what Bash is - Execute commands in Bash - Understand Bash syntax - Use variables - Understand quoting - Use command substitution - Work with environment variables - Customize your Bash…

Key points

  • Variables - Command substitution - echo

Try this

  • ls

Trap

  • Giving a definition without naming a command or file you would check.

71. What is an if statement?

Reveal answer

In short: statement is best answered as: purpose → where it runs → how you inspect it on a live host.

Key points

  • Give a crisp definition of statement in operational terms.
  • Say where it shows up (files, units, packets, cloud construct).
  • Name the first check you would run before changing anything.

Try this

  • for numeric comparison | Use

Trap

  • Giving a definition without naming a command or file you would check.

72. What is the purpose of else?

Reveal answer

In short: purpose else is best answered as: purpose → where it runs → how you inspect it on a live host.

Key points

  • Give a crisp definition of purpose else in operational terms.
  • Say where it shows up (files, units, packets, cloud construct).
  • Name the first check you would run before changing anything.

Try this

  • for numeric comparison | Use

Trap

  • Giving a definition without naming a command or file you would check.

73. What is error handling?

Reveal answer

In short: Understand error handling - Detect runtime failures - Use set options effectively - Display meaningful error messages - Clean up resources using trap - Handle command failures - Write defensive B…

Key points

  • Error Handling — Building Reliable Bash Scripts

Try this

  • set -e
  • set -u
  • set -o pipefail

Trap

  • Giving a definition without naming a command or file you would check.

74. What is the purpose of trap?

Reveal answer

In short: purpose trap is best answered as: purpose → where it runs → how you inspect it on a live host.

Key points

  • Give a crisp definition of purpose trap in operational terms.
  • Say where it shows up (files, units, packets, cloud construct).
  • Name the first check you would run before changing anything.

Try this

  • set -e
  • set -u
  • set -o pipefail

Trap

  • Giving a definition without naming a command or file you would check.

75. What is an exit code?

Reveal answer

In short: An exit code is a numeric value returned by a command after execution.

Key points

  • The shell stores the exit code of the most recently executed command.
  • The script ignored the exit code and continued.
  • Terminate a script with a specific exit code.

Try this

  • echo $?
  • if command

Trap

  • Giving a definition without naming a command or file you would check.

76. What does exit code 0 mean?

Reveal answer

In short: An exit code is a numeric value returned by a command after execution.

Key points

  • The shell stores the exit code of the most recently executed command.
  • The script ignored the exit code and continued.
  • Terminate a script with a specific exit code.

Try this

  • echo $?
  • if command

Trap

  • Giving a definition without naming a command or file you would check.

77. How do you display the last exit code?

Reveal answer

In short: An exit code is a numeric value returned by a command after execution.

Key points

  • The shell stores the exit code of the most recently executed command.
  • The script ignored the exit code and continued.
  • Terminate a script with a specific exit code.

Try this

  • echo $?
  • if command

Trap

  • Giving a definition without naming a command or file you would check.

78. What does the exit command do?

Reveal answer

In short: Check the exit status of important commands. - Exit immediately when critical operations fail. - Use meaningful exit codes. - Return status codes from functions. - Prefer if command over checking…

Key points

  • Understand exit codes - Interpret command status - Use the exit command - Check exit codes using $? - Return exit codes from functions - Use exit codes in conditional statements - Apply exit codes in production automation
  • An exit code is a numeric value returned by a command after execution.
  • The shell stores the exit code of the most recently executed command.

Try this

  • echo $?
  • if command

Trap

  • Giving a definition without naming a command or file you would check.

79. What is a function in Bash?

Reveal answer

In short: Functions are reusable blocks of code that perform a specific task. Instead of writing the same commands multiple times, you can place them inside a function and call it whenever needed. Functions …

Key points

  • Understand Bash functions - Create reusable functions - Pass parameters to functions - Return status codes - Understand variable scope - Organize large scripts - Debug functions - Apply function best practices

Try this

  • Name and run the primary verification command from this lesson topic.

Trap

  • Giving a definition without naming a command or file you would check.

80. How do you define a function?

Reveal answer

In short: Walk through define function as: assess → change → verify → rollback.

Key points

  • Start with the evidence you gather before touching production.
  • List the ordered steps and the privilege needed for each.
  • End with the verification and the rollback if the signal is wrong.

Try this

  • Name and run the primary verification command from this lesson topic.

Trap

  • Giving a definition without naming a command or file you would check.

81. How do you call a function?

Reveal answer

In short: Functions are reusable blocks of code that perform a specific task. Instead of writing the same commands multiple times, you can place them inside a function and call it whenever needed. Functions …

Key points

  • Functions are reusable blocks of code that perform a specific task. Instead of writing the same commands multiple times, you can place them inside a function and call it whenever needed. Functions make Bash scripts easier to read, maintain, debug, and extend. They are widely used in production automation, DevOps pipelines, cloud infrastructure, system administration, monitoring, and deployment scripts.

Try this

  • Name and run the primary verification command from this lesson topic.

Trap

  • Giving a definition without naming a command or file you would check.

82. What does $1 represent?

Reveal answer

In short: represent is best answered as: purpose → where it runs → how you inspect it on a live host.

Key points

  • Give a crisp definition of represent in operational terms.
  • Say where it shows up (files, units, packets, cloud construct).
  • Name the first check you would run before changing anything.

Try this

  • Name and run the primary verification command from this lesson topic.

Trap

  • Giving a definition without naming a command or file you would check.

83. What does the read command do?

Reveal answer

In short: Validate all user input. - Check command-line arguments before use. - Use secure password input with read -s. - Quote variables to prevent word splitting. - Provide meaningful prompts. - Display …

Key points

  • Read user input - Use command-line arguments - Display interactive prompts - Validate user input - Read passwords securely - Use default values - Process multiple inputs - Apply input handling in production scripts

Try this

  • read -p
  • read -s

Trap

  • Giving a definition without naming a command or file you would check.

84. How do you securely read a password?

Reveal answer

In short: Validate all user input. - Check command-line arguments before use. - Use secure password input with read -s. - Quote variables to prevent word splitting. - Provide meaningful prompts. - Display …

Key points

  • Read user input - Use command-line arguments - Display interactive prompts - Validate user input - Read passwords securely - Use default values - Process multiple inputs - Apply input handling in production scripts

Try this

  • read -p
  • read -s

Trap

  • Giving a definition without naming a command or file you would check.

85. Why is logging important?

Reveal answer

In short: Explain why logging important exists: the failure it prevents and the trade-off you accept.

Key points

  • Name the risk or failure mode it reduces.
  • Call out the cost (complexity, latency, ops load).
  • Say when you would choose a different approach.

Try this

  • tail -f

Trap

  • Giving a definition without naming a command or file you would check.

86. How do you append text to a log file?

Reveal answer

In short: ✅ Always review log file growth over time.

Key points

  • ✅ Always review log file growth over time.

Try this

  • tail -f

Trap

  • Giving a definition without naming a command or file you would check.

87. How do you view a log file in real time?

Reveal answer

In short: ✅ Always review log file growth over time.

Key points

  • ✅ Always review log file growth over time.

Try this

  • tail -f

Trap

  • Giving a definition without naming a command or file you would check.

88. What are the three loop types in Bash?

Reveal answer

In short: three loop types Bash is best answered as: purpose → where it runs → how you inspect it on a live host.

Key points

  • Give a crisp definition of three loop types Bash in operational terms.
  • Say where it shows up (files, units, packets, cloud construct).
  • Name the first check you would run before changing anything.

Try this

  • Name and run the primary verification command from this lesson topic.

Trap

  • Giving a definition without naming a command or file you would check.

89. What is the purpose of a for loop?

Reveal answer

In short: purpose loop is best answered as: purpose → where it runs → how you inspect it on a live host.

Key points

  • Give a crisp definition of purpose loop in operational terms.
  • Say where it shows up (files, units, packets, cloud construct).
  • Name the first check you would run before changing anything.

Try this

  • Name and run the primary verification command from this lesson topic.

Trap

  • Giving a definition without naming a command or file you would check.

90. What is the purpose of a while loop?

Reveal answer

In short: A while loop runs as long as the condition is true.

Key points

  • A while loop runs as long as the condition is true.

Try this

  • Name and run the primary verification command from this lesson topic.

Trap

  • Giving a definition without naming a command or file you would check.

91. Why are Bash scripting best practices important?

Reveal answer

In short: Script Best Practices — Writing Professional Bash Scripts

Key points

  • <p class="ra-lesson-meta__crumb" markdownLinux Mastery → Module 10: Bash Scripting → Lesson 10