Linux & Shell Scripting Interview Questions

Linux and shell scripting interviews tend to probe three layers simultaneously: conceptual understanding (can you explain what a process, inode, or exit code actually is), practical fluency (can you write a one-liner or short script under time pressure), and troubleshooting instinct (given a symptom, what would you check first). This guide compiles the questions that recur most often across sysadmin, DevOps, and SRE interviews, with concise, technically precise model answers you can adapt and expand on in your own words during a live interview — interviewers consistently favor candidates who explain their reasoning over those who recite memorized answers.

Q: What happens between pressing Enter on a command and seeing output? A: The shell parses the command line (expanding variables, globs, and aliases), performs any redirection/pipeline setup, forks a child process, and the child execs the target binary, replacing its own image with the new program while inheriting the shell's environment and file descriptors; the shell then waits for the child to exit and captures its exit status. Q: What is the difference between a hard link and a symbolic link? A: A hard link is a second directory entry pointing to the same inode — both names are equally 'real' and the data persists until the last hard link is removed; a symbolic link is a separate file containing a path string, which breaks if the target moves and is visibly distinguishable via ls -l's leading 'l' and arrow notation. Q: What is the difference between a process and a thread? A: A process has its own isolated memory address space, file descriptor table, and PID; threads within the same process share that memory space and most resources but have independent execution stacks and are scheduled independently by the kernel.

Q: Why should you always quote variable expansions like "$var" instead of $var? A: Unquoted expansion undergoes word splitting on IFS characters and glob expansion, so a variable containing spaces or shell metacharacters can be split into multiple arguments or unexpectedly match filenames — quoting preserves the variable as a single literal argument. Q: What is the difference between $@ and $*? A: Unquoted, they behave identically; quoted, "$@" expands to each positional parameter as a separate quoted word (preserving arguments containing spaces), while "$*" expands to a single word joining all parameters with the first character of IFS. Q: What's the difference between [ and [[ in Bash? A: [ is the POSIX test command (also available as /usr/bin/test), subject to word splitting and glob expansion on unquoted variables, requiring careful quoting; [[ is a Bash keyword with more forgiving parsing, supports pattern matching and regex (=~), and short-circuit logical operators (&&, ||) without needing -a/-o.

Q: A cron job works when you run it manually but fails when run by cron — why? A: Cron executes jobs with a minimal environment and a much shorter PATH than an interactive login shell, so commands relying on PATH entries set in .bashrc, or on environment variables exported there, are not available; the fix is to use absolute paths in the script or explicitly source/export needed variables and set PATH at the top of the script or in the crontab. Q: A server's load average is high but CPU usage looks low — what would you check? A: High load with low CPU usage typically points to processes in uninterruptible sleep (D state) waiting on I/O, so I'd check ps aux for D-state processes, iostat or vmstat for disk I/O saturation, and dmesg for storage errors. Q: df shows a filesystem is full but du doesn't find large files — what's happening? A: Almost certainly a deleted file still held open by a running process; check with lsof +L1 or lsof | grep deleted and restart or signal that process to release the space.