Linux Interview Questions for Security & Data Roles
Linux command-line interview questions relevant to SOC, security, and data engineering roles that rely on the command line daily.
How would you find all files modified in the last 24 hours?
find / -mtime -1 -type f searches the filesystem for files with a modification time within the last day — a common step when investigating what changed around the time of a suspected incident.
Explain the difference between chmod and chown.
chmod changes a file's permissions (read, write, execute). chown changes a file's owner and group. Both matter for security — incorrect permissions or ownership are common causes of unauthorized access.
How do you check which process is using a specific port?
lsof -i :PORT or netstat -tulpn | grep PORT shows which process has a given port open — useful when investigating unexpected network activity.
What's the difference between a hard link and a symbolic link?
A hard link points directly to the same inode as the original file — deleting the original doesn't break it. A symbolic link is a pointer to a file path — deleting the original breaks the link.
How would you search for a specific string across multiple log files?
grep -r 'search term' /path/to/logs/ searches recursively through files in a directory, essential for quickly finding relevant entries across a large volume of log data during an investigation.
Go deeper
These questions are just the surface
Our Network Security Foundations program builds the hands-on experience behind these answers — not just memorized responses.
