Unix and Linux Interview Questions and Answers (2026): Commands, Shell Scripting and Scenarios

The short answer: Unix and Linux interviews (for system administrators, DevOps and SRE roles, support engineers and backend developers) test whether you can work confidently at the command line and troubleshoot a real system. Expect questions on the kernel and shell, the file system and permissions, processes and signals, core commands (find, grep, sed, awk, xargs), pipes and redirection, links, shell scripting, cron, and networking, plus one-liners and scenarios such as “the disk is full” or “the server is slow.” Answers below use commands common to Linux and other Unix-like systems; options can differ slightly between GNU and BSD versions.

The shell is widely used: in Stack Overflow’s 2025 Developer Survey, 48.7% of respondents said they had done extensive work in Bash/Shell.

Basics

• “What’s the difference between Unix and Linux?” Unix is a family of operating systems descended from the original AT&T Unix, and “UNIX” is a trademark certified by The Open Group against its specifications (macOS is on The Open Group’s register of certified products). Linux is a Unix-like kernel, written independently, used with GNU and other tools in distributions such as Ubuntu, Debian, Red Hat Enterprise Linux and Alpine. Most Linux distributions aren’t certified UNIX, but they behave very similarly.
• “What are the kernel and the shell?” The kernel manages hardware, memory, processes and files; the shell (Bash, Zsh, sh) is the command interpreter users and scripts talk to.
• “Explain the main directories.” /etc (configuration), /var (variable data such as logs in /var/log), /home (user files), /tmp (temporary files), /usr (programs and libraries), /bin and /sbin (essential commands), /proc (process and kernel information on Linux), /dev (devices).
• “What is an inode?” A data structure storing a file’s metadata (owner, permissions, size, timestamps, data block locations), but not its name, which lives in the directory entry.

Permissions questions

• “Explain chmod 755.” Owner can read, write and execute (7 = 4+2+1); group and others can read and execute (5 = 4+1). Symbolic form: chmod u=rwx,go=rx file.
• “What is umask?” A mask that removes permissions from newly created files and directories. With umask 022, new files are typically 644 and directories 755.
• “What are setuid, setgid and the sticky bit?” Setuid runs a program with the file owner’s privileges (for example passwd); setgid runs with the group’s privileges or, on a directory, makes new files inherit the group; the sticky bit on a directory such as /tmp lets only a file’s owner delete it.
• “How do you change ownership?” chown user:group file, recursively with -R.

Process and signal questions

• “How do you see running processes?” ps aux or ps -ef for a snapshot, top or htop for live use, pgrep name to find PIDs.
• “What’s the difference between kill -15 and kill -9?” SIGTERM (15) asks the process to exit cleanly, so it can clean up; SIGKILL (9) can’t be caught or ignored and stops it immediately. Try SIGTERM first.
• “What are zombie and orphan processes?” A zombie has finished but its parent hasn’t collected its exit status; an orphan’s parent has exited, so it’s adopted by init or systemd.
• “How do you run a job in the background and keep it running after logout?” Add & to run in the background, use jobs, fg and bg to manage it, and nohup command &, tmux or screen, or a systemd service, to keep it running after logout.
• “What does nice do?” Starts a process with a different scheduling priority; renice changes it for a running process.

Essential commands

Pipes and redirection questions

• “What does | do?” Sends one command’s standard output to the next command’s standard input.
• “Explain >, >> and 2>&1.” > writes standard output to a file (overwriting), >> appends, and 2>&1 sends standard error to wherever standard output is going: command > out.log 2>&1.
• “What does tee do?” Writes input both to a file and to standard output, useful for logging while watching.

Links questions

“Hard link or soft (symbolic) link?” A hard link is another directory entry pointing to the same inode; it can’t cross file systems or (normally) point to directories, and the data stays until all hard links are removed. A symbolic link is a separate file containing a path; it can cross file systems and point to directories, but breaks if the target is moved or deleted. Create them with ln target link and ln -s target link.

Shell scripting questions

• “What is the shebang line?” The first line, such as #!/usr/bin/env bash, telling the system which interpreter to run.
• “What are $?, $#, $@ and $0?” The last command’s exit status, the number of arguments, all arguments, and the script name.
• “How do you make scripts safer?” Start with set -euo pipefail (exit on errors, on unset variables and on failures inside pipelines), quote variables ("$file"), and check inputs.
• “Write a loop over files.”

#!/usr/bin/env bash
set -euo pipefail

for file in /var/log/app/*.log; do
  count=$(grep -c "ERROR" "$file" || true)
  echo "$file: $count errors"
done

Cron questions

“Schedule a script to run at 2:30 a.m. every day.” Add a line with crontab -e: 30 2 * * * /opt/scripts/backup.sh >> /var/log/backup.log 2>&1. The five fields are minute, hour, day of month, month and day of week. Use full paths, because cron runs with a minimal environment.

Networking command questions

• ssh user@host and scp or rsync to copy files.
• ping, traceroute and dig or nslookup for connectivity and DNS.
• ss -tulpn (or the older netstat -tulpn) to see listening ports and the processes using them.
• curl -I https://example.com to check an HTTP response.

One-liner exercises

• Top 10 IP addresses in an access log:

awk '{ print $1 }' access.log | sort | uniq -c | sort -rn | head -10

• Find the 10 largest files under a directory: find /var -type f -exec du -h {} + 2>/dev/null | sort -rh | head -10
• Replace a word in all .conf files: sed -i 's/old-host/new-host/g' *.conf (on macOS’s BSD sed, use sed -i '').
• Count lines in all Python files: find . -name "*.py" | xargs wc -l

Troubleshooting scenarios

“The disk is full. What do you do?”

“I’d confirm with df -h which file system is full, then use du -sh from the top of that file system down to find what’s large, usually logs, old releases or temp files. I’d clean up safely or compress old logs, and check for deleted files still held open by a process with lsof +L1, since that space isn’t freed until the process restarts. Then I’d fix the cause, such as adding log rotation, and set an alert at 80%.”

Other scenarios

• “The server is slow.” Check load and CPU with top or uptime, memory with free -h, disk I/O with iostat or iotop, and recent logs; find the process responsible and why.
• “Permission denied when running a script.” Check permissions with ls -l, add execute permission with chmod +x, check the shebang, and check whether the file system is mounted noexec.
• “A service won’t start.” Check systemctl status service and journalctl -u service, then configuration files and ports in use.
• “You can’t SSH into a server.” Check network reachability, the SSH service, firewall rules, keys and permissions on ~/.ssh (for example, 600 on private keys).

Related guides: DevOps engineer interview questions, site reliability engineer interview questions, Kubernetes interview questions and backend developer interview questions.

Frequently asked questions

Sources

• The Open Group, The Open Brand register of certified UNIX products. Read on 2 October 2026.
• GNU, GNU Coreutils manual. Read on 2 October 2026.
• Stack Overflow, 2025 Developer Survey: Technology. Read on 2 October 2026.