Linux Interview Questions for Beginners

 

Linux Fundamentals and Terminal Basics

Q.1-10

Q1. If you've mostly used Windows before how would you explain Linux to an interviewer?

Linux is an operating system just like Windows but it is widely used for servers, cloud platforms, networking, DevOps and enterprise systems. One of its biggest strength is that it gives administrators a lot of control over the system especially through the command line.

I would also mention that Linux is open source and comes in different distributions, such as Ubuntu, Debian, Fedora, and Red Hat Enterprise Linux.

For a beginner level interview, I wouldn't try to make the answer overly complicated. The interviewer mainly wants to know whether you understand where Linux is mostly used and why it is important.

If you're completely new to Linux, start with our guide on Why Learn Linux and How Linux Is Used in Modern IT before practicing these interview questions.

Q2. What's the difference between Linux and a Linux distribution?

Linux is technically the kernel that is the main part of the operating system that provides communication with hardware and manages system resources.

A Linux distribution takes the Linux kernel and combines it with other software, tools, package managers, and desktop or server components to create a complete operating system.

For example:

·  Ubuntu

·  Debian

·  Fedora

·  Red Hat Enterprise Linux

·  Linux Mint

All use the Linux kernel, but they provide different tools, release models, package management systems, and target audiences.

A simple way to explain it in an interview is:

The Linux kernel is the core while a Linux distribution is a complete operating system built around that core.

You may also want to explore guide on what is Linux and its distributions to knowledge of different Linux distributions.

Q3. You've just logged into an unfamiliar Linux server. What would you check first?

There isn't one single correct answer, which is why this can be a good interview question.

I would first check who I am logged in as:

whoami

Then I would check where I currently am:

pwd

After that, I might look at the system information:

hostname

or

uname -a

On a real server, I would avoid immediately changing anything. First, I will understand the server environment. This is reasonable in the real world particularly when dealing with several servers and it is always a good practice to validate such information prior to making any changes.

Q4. What is the difference between pwd, whoami and hostname?

These three commands answer different questions:

pwd

Shows your current directory.

whoami

Shows the user account you are currently using.

hostname

Shows the name of the system you are connected to.

For example, if you are troubleshooting remotely, these commands quickly help to confirm:

·  Who am I?

·  Where am I in the filesystem?

·  Which server am I connected to? 

That can sound simple but in real environments, especially when managing multiple servers, confirming these details before making changes is a good habit.

Q5. Why does Linux rely so heavily on the command line?

The command line allows administrators to perform tasks quickly and consistently. It is especially useful when working with remote servers because many Linux servers do not have a graphical desktop installed.

The command line is also important for:

·  Automation

·  Shell scripting

·  Remote administration

·  Troubleshooting

·  Managing services

·  Searching logs

For example:

man ls

opens the manual page for the ls command. A good Linux administrator is not someone who memorizes everything. It is someone who knows how to investigate and find the right information.

Q6. What is the difference between a command, a shell and a terminal?

These terms are often confused.

·  A terminal is the interface used to interact with the system

·  A shell is the program that interprets with commands you type

·  A command is machine instruction you give to the shell

For example, you might open a terminal and use the Bash shell:

ls -l

In this example:

·  Terminal - the environment where you are typing

·  Bash - the shell processing your request

·  ls - the command being executed

You do not necessarily elaborate all this in a beginner interview but knowing the difference indicates that you are aware of what is going on behind the screen.

Q7. You need to look at everything inside a directory, including hidden files. What would you do?

I will normally use:

ls -la

The -l option displays detailed information, while -a includes hidden files. In Linux, hidden files usually start with a dot (.).

For example:

.bashrc

.profile

.gitconfig

One thing worth mentioning in an interview is that hidden files are not automatically secret or protected. The dot simply makes them hidden from normal directory listings.

Q8. What's the difference between an absolute path and a relative path?

An absolute path is the complete address of the file system. For example:

/home/user/documents/file.txt

This is complete information about location and does not depend on your current directory.

A relative path depends on where currently you are.

For example:

documents/file.txt

If you are currently inside /home/user, then this relative path could point to:

/home/user/documents/file.txt

I usually think of it this way:

An absolute path tells Linux exact location of the object. A relative path tells Linux where is to look based on where you currently are. This becomes particularly important in scripts, automation and troubleshooting.

Q9. What would you do if you forgot what a Linux command does?

I will not guess, especially on an important system. Usually my first option will be:

man command_name

For example:

man grep

Depending on the command, I will also use:

command_name --help

For example:

grep --help

This is actually a good interview question because it shows your approach to learning. Nobody remembers every option for every Linux command.

A stronger answer is:

I would check the manual page or built-in help first, and if necessary, test the command in a safe environment before using it on an important system. This demonstrates caution as well as technical knowledge.

Q10. Why you should be careful about copying commands directly from the internet?

Because a command may behave differently depending on the Linux distribution, version, environment or current directory. Some commands can also make permanent changes or delete data. For example:

rm -rf directory_name

can be useful when used correctly but it can also cause serious problems if you run it against the wrong location.

Before running an unfamiliar command, I will understand:

·  What the command does?

·  What each option means?

·  Which user I am running it as

·  Which directory I am currently in

·  Whether the command changes or deletes anything

·  Whether I can test it safely first

This is a best approach for beginners and experienced administrators alike.

Files, Directories and Everyday Commands

Q.11-20

Q11. You need to create a directory structure for a project. How would you do it?

If I want to create only one directory, I will use mkdir command:

mkdir project

If I needed to create several directories inside each other, I will use the -p option:

mkdir -p project/logs/archive

The good thing about -p is that it creates the missing parent directories automatically. For example creating project, then logs and then archive separately, Linux creates the whole structure in one command using this option.

In an interview, it's worth showing that you understand why you use mkdir -p command, not just memorizing the command.

If you are still learning the Linux command line, practice these essential Linux commands for beginners before moving to advanced interview questions.

Q12. You found a file but you're not sure who owns it. How would you check?

I will use:

ls -l filename

For example:

ls -l report.txt

The output looks something like that:

-rw-r----- 1 john developers 2450 Aug 24 14:30 report.txt

In this example:

·  john is the file owner

·  developers is the group owner

This command also shows the permissions, which are useful because ownership and permissions often need to be checked together when investigates access problems.

Q13. A file is located somewhere on the server, but you don't remember its exact location. How would you look for it?

One option is the find command. For example:

find /home -name "report.txt"

This searches the file name report.txt under /home directory. If I remembered only the part of file name, I will use a wildcard:

find /home -name "*report*"

On a large file system, I will avoid searching the entire file system unless necessary because it may take time and produce permission errors.

A practical answer in an interview will be:

I will start searching in the most likely location first rather than immediately searching the entire server. That shows a sensible troubleshooting approach.

Q14. What's the difference between copying a file and moving a file?

Copying file creates another version of the file while keeping the original in place. For example:

cp report.txt /tmp/

The original report.txt remains where it was and another copy is placed in /tmp.

Moving changes the file's location:

mv report.txt /tmp/

After that, the file is no longer in its original directory. The mv command is also commonly used to rename files:

mv old-report.txt new-report.txt

A beginner should remember:

cp command creates a copy of file and mv changes the location or name.

Q15. You want to see the contents of a large text file. Would you always use cat?

Not necessarily. cat is useful for quickly displaying small files:

cat file.txt

But if the file is very large so dumping everything onto the terminal is not always helpful. In that case, I will use:

less file.txt

This lets me scroll through the file.

Or, if I only want to see the beginning:

head file.txt

For the end of a file:

tail file.txt

This question is useful because it tests someone whether understands that Linux commands should be chosen based on the situation.

Q16. A log file is constantly receiving new entries. How you could inspect it in real time?

I will usually use:

tail -f /var/log/example.log

The -f option keeps the command running and displays new lines as they are added to the file. This is particularly useful when troubleshooting something that is happening right now.

For example, I restart a service to see whether new errors appear, I can monitor the relevant log while performing the action.

A more practical approach will be like this:

tail -f /var/log/messages

The exact log file can vary depending on the Linux distribution and logging configuration, so I would first identify where the relevant logs are being written.

Q17. You accidentally create a file in the wrong directory. How would you move it without creating another copy?

I will use mv command. For example:

mv /tmp/report.txt /home/user/documents/

This moves the file from /tmp to /home/user/documents directory.

Before running the command especially on a production system, I would make sure I understand the source and destination paths. One common mistake by beginner is assume that they are in the correct directory. That's why commands like these are useful before making changes:

pwd

ls

By checking your current location can prevent simple mistakes.

Q18. How would you quickly search for a specific word inside a log file?

I will use grep command. For example:

grep "error" application.log

This displays lines containing the word error. If I want to ignore case differences, I will use:

grep -i "error" application.log

So it will match:

error

ERROR

Error

For troubleshooting, grep becomes even more useful when combined with other commands or when searching for timestamps, usernames, IP addresses or specific error messages. The important thing to understand is that grep helps to filter information rather than forcing you to manually read a big file line by line.

Q19. What would you check before deleting a directory from a Linux server?

Before deleting anything, I will first confirm exactly where I am and what I am about to remove. For example:

pwd

ls

If the directory contains any important data, I will consider whether it needs to be backed up or it is safe to remove. A command such as:

rm -r directory_name

Removes a directory and its contents. -f option removes forcefully without many of the usual prompts:

rm -rf directory_name

That is why I will give special attention to this.

A good interview answer isn't simply:

I would run rm -rf.

A better answer is:

I will verify the path and contents first because recursive deletion can remove a large amount of data very quickly. That shows good administrative habits.

Q20. What is the difference between > and >> when working with files?

Both operators are used for output redirection, but they behave differently.

The > operator writes output to a file and replaces its existing contents.

Example:

echo "First line" > notes.txt

If notes.txt already contains data, that data will be overwritten.

The >> operator adds output to the end of a file.

Example:

echo "Another line" >> notes.txt

This is commonly used when adding information to logs or output files.

A simple way to remember it:

> replaces

>> adds

This is a useful beginner interview question because output redirection is used constantly in Linux administration and scripting.

Users, Groups and Linux Permissions

Q21-30

Q21. A user says, "I can see the file but I can't open it." What would you check first?

I will first check the file's permissions and ownership:

ls -l filename

For example:

-rw------- 1 john developers 2048 Aug 24 report.txt

This tells me:

·  Who owns the file

·  Which group owns it

·  What permissions are assigned

I will also check which user is trying to access the file:

whoami

One important point is that I wouldn't immediately run chmod 777 command. First, I will try to understand why access is denied and then will make a small appropriate change.

It is a reasonable answer in an interview as it demonstrates that you are not rectifying every permission problem blindly by making everything open to all.

Q22. What is the difference between a user and a group in Linux?

Each user represents an individual account on the system. Each user can have their own files, permissions and settings.

group is used to organize users with similar access need.

For example, If three administrators who all need access to the same application directory so instead of assigning permissions individually to each person, they can all be added to a group.

You can check your user and group information with:

id

The output of this command shows your user ID, primary group and any additional groups you belong to. Groups make permission management easier especially on systems with multiple users.

User accounts and permissions are among the most important Linux administration topics. If you want more practice, continue with our detailed guides on Linux users and groups.

Q23. How would you explain r, w and x permissions to a beginner?

The three basic Linux permissions are:

·  r — Read

·  w — Write

·  x — Execute

For a regular file:

·  Read allows you to view its contents

·  Write allows you to modify it

·  Execute allows you to run it as a program or script

For a directory, the meaning is slightly different. For example:

·  Read allows you to see directory contents

·  Write allows you to create, remove or rename entries in the directory, subject to other permission checks

·  Execute allows you to traverse or access the directory

The interviewer sometime asks this question, what a difference between file and directory permissions is because it shows whether you understand permissions beyond simply memorizing rwx.

Q24. What does mean by chmod 755?

The number represents permissions for:

1.    Owner

2.   Group

3.   Others

The number 755 breaks down like this:

7 = read + write + execute

5 = read + execute

5 = read + execute

You could apply it with:

chmod 755 filename

This permission is commonly assigned on directories and executable files where the owner needs full access while other users only granted to read or execute.

In an interview, it is better to explain the numbers rather than just saying, "755 gives permissions."

Q25. Why might you use sudo instead of logging in directly as root?

sudo allows an authorized user to run a specific command with elevated privileges without logging as root user all the time. For example:

sudo systemctl restart nginx

This is generally safer than logging in as root user and performing all tasks with unrestricted privileges.

The main reason is that mistakes can have a much bigger impact when you are working as root. Using sudo also makes it easier to control who can perform administrative tasks.

A good beginner answer will be:

I would use normal user access for everyday work and elevate privileges only on the need basses.

That shows an understanding of the principle of least privileges, using only the level of access is needed for the task.

Q26. A user can read a file but cannot modify it. What does it tell you?

One possible explanation is that the user has read permission but does not have write permission.

For example:

-r--r----- 1 john developers report.txt

The owner can read the file, but nobody has write permission based on the mode shown. However, I wouldn't automatically assume that file permissions are the only reason. I would check:

ls -l report.txt

and identify:

·  The file owner

·  The group owner

·  The permissions

·  Which user is trying to modify it

In some situations, the filesystem or other security controls can also affect write access. The key point is to investigate before changing permissions.

Q27. What is ownership in Linux and why does it matter?

Every file and directory is associated with an owner and a group. You can see this using:

ls -l

Example:

-rw-r----- 1 john developers report.txt

Here:

·   john is the owner

·  developers is the group

Ownership does matter because Linux uses both file ownership and permissions together to control the access a file.

If the wrong user owns a file, an application or service may not be able to read or write to it. This is a common issue when files are manually copied into application directories or restored from backups.

If you want more practice, continue with our detailed guide on Linux directory structure and file system.

Q28. You need to change the owner of a file. Which command would you use?

I will use chown command to change ownership of a file. For example:

sudo chown john report.txt

This changes the ownership of a file named report.txt to john. You can also change the owner and group together:

sudo chown john:developers report.txt

Before changing ownership, I will check the current settings:

ls -l report.txt

Changing ownership can affect applications and services so I will avoid making changes unless I understand which account should own the file.

Q29. What is the difference between chmod and chown?

They are used to solve different problems. chmod changes permissions on files and directories.

For example:

chmod 644 report.txt

chown changes ownership. For example:

chown john report.txt

A simple way to remember is:

chmod = who can do what

chown = who owns it 

 They are often used together when fixing access problems but they should not be confused. For example, if changing permissions may not solve a problem then may be the file owned by the wrong user and the application expects a specific owner.

Q30. What does execute permission mean on a directory?

This is a question that often confuses beginners.

On a regular file execute permission generally means the file can be run as a program or script. execute permission  On a directory allows a user to traverse the directory or access items inside it because the relevant permissions are already assigned.

For example, you might have permission to see that a directory exists, but without the required access permissions, you may not be able to enter it or access files inside it.

You can check directory permissions with:

ls -ld directory_name

Notice the -d option. Without it, ls may list the contents of the directory instead of showing information about the directory itself.

It will be a strong interview answer if you mention that:

Permissions behavior will be different depending on whether they are assigned to a file or a directory. That shows a better understanding than simply memorizing rwx.

Processes, Services and Basic Troubleshooting

Q.31-40

Q31. A website running on a Linux server is no longer responding. Where would you start?

I will avoid guessing immediately. First, I will try to narrow down where the problem is. For example, I would check whether the relevant web service is running:

systemctl status nginx

Or, depending on the environment:

systemctl status httpd

If the service is running, I would check whether the server itself has any obvious problems such as high CPU usage, memory pressure or a full file system. I will also check the service logs for errors.

IT is not a good interview answer that:

I will restart the server.

A better answer is:

I will first identify whether the problem is with the service, server, the network or the application before making changes. That shows a structured troubleshooting mindset.

Q32. How would you see which processes are currently running on a Linux system?

One of most common command is:

ps aux

This displays information about running processes, including the user running the process, process ID, CPU usage, memory usage, and the command. For a live view, I will use:

top

This is useful when I want to watch processes while the system is running. Depending on the environment, htop can also provide an easy to read interactive view of processes if it is installed.

The important difference between ps and top is that ps gives you a snapshot while tools like top continuously update the information.

Understanding processes and services becomes especially important when troubleshooting Linux servers. You can continue with our guide on Linux process management for beginners.

Q33. A server’s performance is slow. How would you find out whether a process is using too much CPU or memory?

I will start with a monitoring tool such as:

top

This allows me to view processes that are consuming too much CPU and memory. I would look for:

·  Processes using unusually high CPU

·  Processes consuming large amounts of memory

·  Processes that keep appearing or restarting

·  Overall system load

 

However, I wouldn't automatically kill the process just because it is using a lot of resources. Some applications are expected for significant CPU or memory usage during normal workloads. The next step would be to understand what the process is and why it is consuming resources.

This is an important distinction in an interview that High resource usage is a clue instead of automatically the root cause.

Q34. What is the difference between stopping a service and disabling a service?

Stopping a service just hurts the current working related to that service. For example:

sudo systemctl stop nginx

This stops the service. Disabling a service affects whether it starts automatically in the future:

sudo systemctl disable nginx

A service can be stopped and enabled even it may start again after a reboot. Likewise, a service can be disabled but currently running until you stop it.

A simple way to remember it:

Stop controls the current state. Disable controls automatic startup.

Q35. A service has failed. How would you restart it?

If I already know the service name then I will use:

sudo systemctl restart service-name

For example:

sudo systemctl restart nginx

But before restarting the service especially in an interview scenario, I will usually check why it failed:

systemctl status nginx

This may provide useful information about the failure. If I restart a service without checking anything this will temporarily hide the problem without understanding the cause.

So a stronger answer will be:

First I will check the service status and relevant logs. If restarting is appropriate, I would restart the service and then confirm that it came back successfully.

Q36. When would you use kill and why shouldn't kill -9 be your first option?

The kill command is used to send a signal to a process. For example:

kill 1234

By default this sends a termination signal and gives a chance to the process to shut down cleanly. Sometimes a process may not respond and stronger signals may be necessary.

For example:

kill -9 1234

This forcefully terminates the process. This is the reason I will not use kill -9 immediately becuase the process does not get a chance to clean up properly. Depending on the application, that could result in incomplete operations or other problems.

A better approach is to:

1.    Identify the process

2.   Understand what it is doing

3.   Try a normal termination first

4.   Use stronger action only if necessary

Q37. An application cannot connect to a service on a specific port. How would you check whether anything is listening on that port?

This is a useful command:

ss -tulpn

This can display listening network sockets and the processes associated with them. To check a specific port, I could filter the output:

ss -tulpn | grep 8080

If nothing is listening on the expected port then I will investigate whether the service actually started correctly or it is configured to use a different port.

If the service is listening then I will continue checking areas such as firewall rules, network connectivity and application configuration. This is a good example of troubleshooting step by step instead of assuming that the network is immediately the problem.

Q38. A service starts but immediately stops again. What would you investigate?

My first step will be:

systemctl status service-name

I will look for any obvious error messages. Then I would check the service logs of service. On systems using systemd a common command is:

journalctl -u service-name

I would investigate things such as:

·  Configuration errors

·  Missing files

·  Permission problems

·  Another process already using the required port

·  Missing dependencies

·  Incorrect environment settings

I will also check whether anything changed recently. For example:

·  Was the service updated?

·  Was the configuration modified?

·  Were certificates changed?

·  Was the server rebooted?

In troubleshooting, recent changes can often provide an important clue.

Q39. How would you check logs for a service managed by systemd?

I will normally use journalctl command. For example:

journalctl -u nginx

This shows log entries related to the Nginx service. To see the most recent entries first, I could use:

journalctl -u nginx -e

And to follow new messages as they appear:

journalctl -u nginx -f

Logs are extremely useful because they often provide more information than simply seeing that a service has failed. Instead of repeatedly restarting a failed service, I will check the logs and try to understand what the system is reporting.

Q40. What is the difference between a process and a service?

A process is a running instance of a program. For example, when you run a command or application, Linux creates a process.

A service is usually a program designed to run in the background and provide functionality to the system or other applications.

Examples include:

·  Web servers

·  Database servers

·  SSH

·  DNS services

On many modern Linux systems, services are managed through systemd. For example:

systemctl status ssh

A simple way to explain the difference is:

A process is something which is currently running. A service is usually a long running background application which is managed by the operating system. A service can also have one or more processes associated with it.

Disk Space, Filesystems and Storage

(Q.41-50)

Q41. A server reports “No space left on device.” What would you check first?

My first step will normally be:

df -h

This shows the usage of mounted filesystems in a human-readable format. I would look for a filesystem that is close to or at 100% usage. For example:

Filesystem      Size  Used Avail Use% Mounted on

/dev/sda2        50G   49G  1G    98% /

In this case, the root filesystem is nearly full. I will not immediately start deleting files. First I will identify what is consuming the space and whether the files are safe to remove.

A good troubleshooting approach is:

1.    Check filesystem usage

2.   Identify the affected file system

3.   Find which directories are using the space

4.   Investigate why the usage increased

5.   Remove, archive or move data only when it is safe

Disk space problems are common on Linux servers. Learning how to investigate filesystem usage is an important skill for both interviews and real-world administration.

Q42. What is the difference between df and du?

This is a very common Linux interview question but it is more useful when explained practically.

df shows how much space is being used on mounted filesystems. For example:

df -h

du shows how much space files and directories are using. For example:

du -sh /var/log

A simple way to remember it is:

df helps you find out which filesystem is full

du helps you find out what is consuming the space

If /var is filling up, I might first check the filesystem with df -h and then investigate directories inside /var using du.

Q43. You know a filesystem is filling up. How would you find the directories using the most space?

I will start with:

du -sh /var/*

This gives me a summary of the size of directories and files directly under /var. If I wanted to sort the results:

du -sh /var/* 2>/dev/null | sort -h

This can help to identify which directories deserve further investigation. For example, I might discover that /var/log is unusually large.

I will investigate further:

du -sh /var/log/*

The important thing is to narrow down the problem gradually instead of running commands against the entire file system without a clear direction.

Q44. df -h shows that the filesystem still has space but an application says “No space left on device.” What else could you check?

One possible cause is inode exhaustion.

Linux filesystems use inodes to store information about files. A filesystem can run out of available inodes even when there is still disk space available.

I will check inode usage with:

df -i

If the inode usage is close to 100%, the system may be unable to create new files. This can happen when a system contains a very large number of small files.

For example, an application might generate millions of temporary files. Each file may be small but together they can consume all available inodes.

This is a good interview question because it tests whether someone knows that disk problems are not always caused by large files.

45. What is a mount point in Linux?

A mount point is a directory or folder in an operating system file structure where a filesystem is attached to make it accessible.

For example:

/

is the root of the Linux filesystem. Another filesystem might be mounted at:

/data

This means the attached filesystem becomes accessible through /data. You can see mounted filesystems using:

df -h

or

mount

A simple way to explain it is:

A mount point is the point in the Linux directory structure where a filesystem is attached and made available.

46. Why would a system administrator want separate filesystems for directories such as /var or /home?

Separate filesystems help to isolate disk usage.

For example, /var often contains:

·  Logs

·  Application data

·  Cache files

·  Temporary data

If an application suddenly generates a huge amount of log data, a separate /var filesystem can prevent that problem from consuming all available space on the root filesystem. Similarly, /home can be separated to manage user data independently.

The exact filesystem layout depends on the environment but separating important areas can make storage management easier and help to limit the impact of uncontrolled disk usage.

47. How would you check which filesystems are currently mounted?

One simple option is:

df -h

This displays mounted filesystems along with their disk usage.

Another command is:

findmnt

This command gives a clear overview of the mounted hierarchy on many modern Linux systems.

For example:

findmnt

can show where filesystems are mounted and what devices they are associated with. The first troubleshooting step I will undertake to troubleshoot a storage problem is to verify that the desired filesystem is indeed mounted where expected.

48. A directory that normally contains important application data suddenly appears empty. What would you check before assuming the data was deleted?

I will first check whether the filesystem that normally contains the data is mounted.

For example:

df -h

or

findmnt

If an application uses a separate filesystem mounted at a directory such as:

/data

and this filesystem is failed to mount, the /data directory itself may still exist but appear empty. This will be dangerous if someone assume that the data is disappeared and start copying new files into the directory.

If the original filesystem is later mounted, those newly created files could be hidden underneath the mounted filesystem. So before assuming data was deleted, I will check the mount status.

49. What is the difference between deleting a file and freeing disk space?

Usually, deleting a file frees the disk space it was using. However, there are situations where that may not happen immediately. For example, a process might still have the deleted file open.

The file may no longer appear in a normal directory listing but the running process can still hold the file open and continue using disk space. In that situation, simply using df and du may produce confusing results. A useful troubleshooting command can be:

lsof +L1

This can help to identify open files that have been deleted but are still being hold by running processes.

A beginner doesn't need to memorize this command but understanding the concept is valuable. If disk usage doesn't make sense, don't assume that the problem is always visible in the directory structure.

50. A file system is almost full. Would you immediately delete the largest files?

Not necessarily. First, I will identify what those files are and why they exist.

For example, a large file might be:

·  An important database file

·  An application log

·  A backup

·  A temporary file

·  A virtual machine disk

A file being actively used by a running application 

Deleting the wrong file may cause a bigger problem than the disk issue itself.

My approach would be:

1.    Identify the file system that is full

2.   Identify the largest directories and files

3.   Understand what the files belong to

4.   Check whether they can be safely removed, rotated, archived or moved

5.   Verify the available space after appropriate step

For an interview, this answer demonstrates something important:

Good Linux administration is not about knowing the fastest command to delete data. It is about understanding the impact before making changes.

📚 Related Articles

🐧 What Is Linux?

Start with the basics and understand what Linux is, how it works, and why it is widely used.

💿 Linux Distributions Explained

Learn what Linux distributions are, why different distributions exist, and understand popular options such as Ubuntu, Debian, Fedora, and Red Hat Enterprise Linux.

💻 Linux Commands for Beginners

Learn essential Linux commands for navigating files, managing directories, searching information, and performing everyday administration tasks.

⚡ Linux Process Management for Beginners

Understand Linux processes and services, including how to view, manage, and troubleshoot running programs.

SeekLinux Team
Linux Engineers | DevOps | Security Enthusiasts

SeekLinux Team shares practical Linux tutorials, SSL/TLS certificate guides, commands and DevOps solutions. Our goal is to simplify system administration and help you master real-world server and security tasks.

Learn more about us →